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PREFACE 



APPLIED MICROSYSTEMS CORPORATION is proud of its role in the 
systems development industry and conscious of its important contribution. 
However, it assumes no liability for errors or for any damages that may 
result from use of this manual or the equipment it accompanies. 

We have made every effort to document this product accurately and 
completely. We reserve the right to make changes to this manual without 
notice. 

The ESI 800 Emulator is intended for use in developing, debugging, and 
testing Intel 80286 microprocessor-based systems. This manual assumes 
the user is familiar with the terminology of the 80286 microprocessor. 

Unpacking and Inspection 

Your Emulator has been inspected and tested for electrical and mechanical 
defects before shipping, then configured for the line voltage you 
requested. Although the Emulator was carefully packed, check it for 
possible transit damage and verify that the following units are present. If 
you find any damage, file a claim with the carrier and notify Applied 
Microsystems Corporation (Customer Service 1-800-426-3925). 
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STANDARD EQUIPMENT 

■ Emulator chassis with power cord 

■ Main control boards and pod assembly 

■ ES1800 Emulator Reference Manual for the 80286 
Microprocessor 

OPTIONAL EQUIPMENT 

■ Control Boards 

■ overlay memory 

■ symbolic debug 

■ Logic state analysis pod assembly 

■ Carrying case 
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Warning 

This equipment generates, uses, and can radiate radio frequency energy 
and if not installed and used in accordance with the instructions manual, 
may cause interference to radio communications. It is temporarily 
permitted by regulation and has not been tested for compliance with the 
limits of Class A computing devices pursuant to Subpart J of Part 1 56 of 
FCC Rules, which are designed to provide reasonable protection against 
such interference. Operation of this equipment in a residential area is 
likely to cause interference. It is up to the user, at his own expense, to take 
whatever measures may be required to correct the interference. 
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Service 

If the ESI 800 unit needs to be returned for repairs, Applied Microsystems 
Customer Service will issue a Return Authorization number. To obtain the 
necessary Return Authorization number and shipping information call 
1-800-426-3925, and ask for Customer Service. After the expiration of 
the warranty period, service and repairs are billed at standard hourly rates, 
plus shipping to and from your premises. 
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Limited Hardware Warranty 

Applied Microsystems Corporation warrants that all Applied Microsystems 
manufactured products are free from defects in materials and 
workmanship from date of shipment for a period of one (1) year, with the 
exception of mechanical parts (such as probe tips, cables, pin adapters, test 
clips, leadless chip sockets, and pin grid array adapters), which are 
warranted for a period of 90 days. If any such product proves defective 
during the warranty period, Applied Microsystems Corporation, at its 
option, will either repair or replace the defective product. This warranty 
applies to the original owner only and is not transferable. 

To obtain warranty service, the customer must notify Applied 
Microsystems Corporation of any defect prior to the warranty expiration 
and make arrangements for repair and for prepaid shipment to Applied 
Microsystems Corporation. Applied Microsystems Corporation will 
prepay the return shipping to US locations. For international shipments, 
customer is responsible for all shipping charges, duties and taxes. Prior to 
returning any unit to Applied Microsystems Corporation for warranty 
repair, a return authorization number must be obtained from Applied 
Microsystems Corporation's Customer Service Department (see Service 
section). 

This warranty shall not apply to any defect, failure, or damage caused by 
improper use, improper maintenance, unauthorized repair, modification, 
or integration of the product. 
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Hardware Extended Warranty 

Applied Microsystems Corporation's optional EXTENDED WARRANTY 
is available for all hardware products for an additional charge at the time 
of the original purchase. The EXTENDED WARRANTY may be 
purchased to extend the warranty period on mechanical parts normally 
restricted to 90 days to a total of one (1) or two (2) years and to extend the 
warranty on electrical parts and all other mechanical parts to two (2) years. 

Hardware Service Agreements 

SERVICE AGREEMENTS are available for purchase at any time for 
qualified Applied Microsystems Corporation manufactured products. The 
SERVICE AGREEMENT covers the repair of electrical and mechanical 
parts for defects in materials and workmanship. For information, contact 
your local sales office. 
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Section 1 



INTRODUCTION 



The ESI 800 Emulation system allows you to analyze and control a target 
environment, consisting of hardware or software, in real time. To use the 
ESI 800 with your target hardware, simply remove the target system's 
microprocessor and plug in the ESI 800 Emulator. Your system uses the 
Emulator in place of the microprocessor and behaves as if the target 
microprocessor were there. It continues to run until you manually stop it 
or it encounters a user-defined stop condition. This predefined condition 
can be in the form of single-step operation statements or more complex 
event monitoring (WHEN/THEN) statements. 

During the debugging or integration process you can read and write to the 
microprocessor registers or memory locations and execute programs 
contained in the target system memory. The ESI 800 Emulator also allows 
you to debug software without being physically connected to the target 
system. In this configuration, the Emulator uses its own real-time clock 
feature combined with overlay memory capabilities. 

Information in this manual applies to the Intel 80286 microprocessor only. 
For more complete information on this chip, refer to the Intel iAPX286 
Hardware Reference Manual and the Intel iAPX286 Programmer's 
Reference Manual published by Intel Corporation. 
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How to Use This Manual 

This manual is your guide to using the Applied Microsystems 
Corporation's ESI 800 for the 80286 microprocessor. For your first time 
using the ESI 800, read through the Introduction and Getting Started 
sections and refer to the Hardware section to make sure your hardware is 
set up correctly. 

Once you are familiar with the Emulator, Chapters 4, 5, 6 and 7 provide 
information on all of the available commands. The comprehensive index 
and Appendix A: ES Language Mnemonics are useful for finding specific 
information in the manual. 

The manual is organized as follows: 

Section 1: Introduction introduces Applied Microsystem Corporation's 
ESI 800 Emulator for the 80286. It explains emulation, setup, and 
configuration requirements, and provides an overview of the features of 
the ESI 800. 

Section 2: Getting Started provides a checklist for setting up the Emulator 
and target system, starting and testing the Emulator, and storing 
customized system variables in EEPROM. 

Section 3: Hardware contains all the information on the Emulator, the 
control boards, the rear panel, the pod, and the serial ports, as well as 
information on maintenance and troubleshooting. 

Section 4: ES Language explains the structure of the language that 
controls the Emulator, with explanations of the help menus, prompts, 
special modes and characters, and language related error messages. 

Section 5: System Commands provides a reference to commands that 
control the Emulator system. It is divided into sections on setup, serial 
communications, download operations, registers, trace memory, macros, 
and symbols. 

Section 6: Target Commands provides a reference to commands that 
directly control the target system. It is divided into sections on running the 
target program, overlay memory commands, the line assembler, the 
memory disassembler, memory and I/O modes, and special functions. 
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Section 7: Event Monitor System explains the powerful breakpoint and 
control system, including the structure of the system, breaking emulation, 
counting events, using special interrupts, and tracing events. 

The Appendices include a quick reference to ES Language mnemonics, 
explanations of the hardware error messages and serial data formats. 
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System Setup 

The ESI 800 can debug and integrate software and hardware. Setups for 
each system may be different. In every combination, there is a "target" 
system, which can be hardware, software alone (if you are using the 
Emulator's overlay memory to debug software), or a combination of the 
two. The target system is the environment you intend to emulate. 

The ESI 800 Emulator consists of a chassis assembly which houses the 
control boards and an Emulator pod which houses the emulating 
microprocessor. The Emulator can be controlled with a terminal, which 
can be your development system CRT or another device set to function in 
terminal mode. You can enhance this basic system by adding the optional 
logic state analyzer (LSA) pod. This provides 16 additional input lines, 
giving access to signals other than the normal address, data, and control 
signals of the microprocessor. You may also add an optional overlay 
memory board. Overlay memory can be mapped anywhere in the address 
space of the target system. The overlay memory board provides additional 
capabilities, including the ability to debug software with or without a 
target system. 

The stand alone environment (refer to diagram on following page) consists 
of the Emulator and a dumb terminal or equivalent connected to the 
terminal port. This configuration can debug target systems with software 
already installed or short, hand-entered routines. The stand-alone 
configuration is common in manufacturing test and service facilities. 

The Emulator can also use data stored in a host development system by 
setting up a hosted environment (refer to diagram on following page). The 
Emulator is still under the direct control of the CRT but can load data 
from the host system's data files. 

By attaching a printer, data and code from the target system can be printed 
out in assembly language. You can also print all Emulator commands and 
their results. The Emulator system has two serial ports and uses standard 
RS232C serial port protocol. Each port can be independently configured 
for baud rate, data length, and number of stop bits. 

Software for driving the Emulator is available from Applied Microsystems 
Corporation for the IBM PC and compatibles, SUN, APOLLO and VAX. 
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Figure 1. Environments 
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The Emulator can also be totally controlled by a host system. This hosted 
software environment (refer to diagram on previous page) requires special 
host resident software. Drivers and high level debuggers are available 
from Applied Microsystems for most languages and host systems. 
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System Operation 

OVERVIEW 

The ESI 800 has two basic operational modes: emulation and pause. Pause 
mode is generally used to set up the system configuration and to display 
information after exiting emulation. System setup is accomplished from 
two menus. The first menu contains all external communication variables; 
the second contains the control switches for emulation. Both setups can be 
saved to EEPROM and automatically loaded at power-up. 

Emulation, or run mode, means that the microprocessor in the Emulator 
pod is running a program in the target system, allowing you to see what is 
happening within the target system. Emulation stops when (1) you stop it, 
(2) user-defined breakpoints are enabled and occur, (3) you reset the 
system, or (4) errors occur in the target system. 

When you manually stop emulation or a breakpoint is reached, you enter 
pause mode. All registers and addresses are then available for 
examination, along with a trace history of performance of the 
microprocessor. A command language allows you to enter emulation mode 
in the desired state and leave emulation when the desired combination of 
events are detected in the target. 

ES LANGUAGE 

The ESI 800 uses its own command language. To benefit from the 
sophisticated operations of the Emulator, you must understand the general 
concepts of this language. The Emulator operates in response to command 
statements composed of command mnemonics and, for some commands, 
arguments. An argument to a command is an additional value entered as 
part of the command sequence, such as an address range or base value. 
Arguments can consist of single values, expressions, or lists. 

The command statements form a control language, similar to higher-level 
computer languages. And, like a computer language, the operators and 
values can be combined to form complex expressions. Statements have a 
maximum length of 76 characters and can be extended by the use of 
macros. 
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The ES Language contains registers, counters, and conditional statements 
allowing the user full control over the operation of the target system. To 
complete the language, a full set of error messages is provided for (1) 
target hardware, (2) Emulator hardware, (3) target software, and (4) ES 
command language syntax. 

REAL-TIME 

Since the pod processor is identical to the target microprocessor, the target 
system runs in real time. No wait states are inserted by the Emulator 
during run mode. 

NULL TARGET 

When there is no target system, you may select the internal clock feature, 
which places the Emulator in null target mode. In this mode a 12.5 MHz 
clock is supplied to the CPU, and unterminated inputs are set inactive. 
Overlay memory can then be used to develop code as if a target system 
were attached. 

TRACE MEMORY 

Trace memory functions as a history of the target system program's 
execution. This memory can record 2046 bus cycles and display these in 
assembly language. All address lines, data lines, processor status lines, and 
16 bits of external logic input are traced. If something unexpected 
happens during program execution, trace memory can be reviewed to 
determine the sequence of instructions executed by the CPU prior to the 
unexpected event. When used in conjunction with the trace disassembler, 
hardware and software problems can be quickly tracked down. 

Trace memory can be selectively switched on by the Event Monitor to 
trace events only when certain conditions are met. Program execution can 
be stopped at any point, either manually or using the Event Monitor 
System. The address, data, and control signals of the most recently traced 
cycles can then be critically reviewed. 
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OVERLAY MEMORY 

Overlay memory is Emulator working memory, which can be used in a 
variety of ways. When debugging software without target hardware, the 
target program is loaded into overlay memory, where it can be edited and 
positioned in the target system address space as desired (null target mode). 
The program executes in real time as if it resided totally in the target 
system. Overlay memory is also useful when a target is connected, for 
loading portions of software, making patches, and checking programs not 
yet committed to PROM. 

The overlay memory is RAM with appropriate address and control logic, 
ranging in size from 32K to 2M bytes and locatable in 2K-byte segments 
throughout the system. Each segment can be assigned one of four 
attributes: target, read/write, read-only, or illegal. Unmapped memory is 
assigned the target attribute by default. Overlay memory mapped as read- 
only can always be modified by the Emulator operator. However, if a 
program tries to write to read-only overlay, emulation stops and an error 
message is displayed. Overlay memory mapped as read/write can be 
written to or read from. If a program attempts to read or write to memory 
mapped as illegal, emulation stops and an error message is displayed. 

When a segment of memory is mapped, program accesses in that memory 
range are directed to the overlay instead of the target. Overlay memory 
accesses occur in real-time, with no wait states added by the Emulator. 

EVENT MONITOR SYSTEM 

The ES1800's Event Monitor System provides unprecedented breakpoint 
and system control, enabling the user to isolate and break on any 
predefined series of events and then perform actions defined by 
WHEN/THEN conditional statements. The user controls and monitors the 
target with the Event Monitor System by defining statements that specify 
exact or multiple events through logical combinations of address, data, 
status, pass counter, and optional logic field states. When those events are 
encountered in the target system program, the ESI 800 can break 
emulation, trace specific sequences, count events and trigger outputs all 
independently, allowing the user to analyze the cause-effect relationship 
established by the event/action sequences defined. 
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The Event Monitor System uses four groups containing eight registers each 
to let the user monitor a complex series of events through multiple actions 
and combinations of comparator registers. The system uses one group at a 
time, with each WHEN/THEN statement active in a specific group. 
WHEN/THEN statements can switch to different groups and access 
conditional statements and registers for that group. The user can control 
the tracing of 2046 machine cycles, selecting the desired instructions to be 
recorded in the trace memory. 

OPTIONAL SYMBOLIC DEBUGGER 

The symbolic debug option allows you to assign frequently used values to 
symbol names that make sense. Features include: 

■ Reference to an address by a name instead of a value 

■ Display of all symbols and sections with their values 

■ Editing (entry and deletion) of symbols and their values 

■ Automatic display of symbolic addresses during 
disassembly 

■ Section (module) symbols that can be used as range 
arguments and for section offsets in trace disassembly 

■ Upload and download of symbol and section definitions 
using standard serial formats 

Because symbols are a powerful extension of the Emulator, they are 
frequently used in examples throughout Section 5, System Commands. 
Please note that if you have not yet purchased the symbolic debug option, 
you may need to modify these examples. 

OPTIONAL LOGIC STATE ANALYZER (LSA) 

LSA inputs can qualify event specifications in the Event Monitor System. 
In the simplest form, specific bit patterns at the LSA inputs can cause a 
breakpoint. The LSA comparator can detect arbitrarily complex event 
specifications as well. The LSA allows tracing of additional signals in the 
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target system. This is useful when monitoring (1) buffers suspected of 
failure, (2) decode logic, (3) memory management circuit translations, and 
(4) for asynchronous external events. 

DIAGNOSTIC FUNCTIONS 

Diagnostics available in the ESI 800 Emulator include both RAM/ROM 
tests and scope loops. RAM test routines verify that RAM is operating 
properly. They can be run on the target or Emulator overlay memory and 
may be executed in either byte or word mode. ROM tests include a built- 
in CRC algorithm. 

High speed memory and I/O scope loops for troubleshooting with an 
oscilloscope are built into the Emulator firmware. They can be used for 
locating stuck address data, status or control lines, and generating 
signatures using signature analysis equipment. 

The firmware that generates the scope loops is optimized for maximum 
speed of execution. This short cycle time allows the hardware engineer to 
review the timing of pertinent signals in the target system without using a 
storage oscilloscope. The scope loops can be executed in either byte or 
word mode. 
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GETTING STARTED 



Introduction 

This section provides a checklist for setting up the Emulator and target 
system, starting and testing the Emulator and storing customized system 
variables in EEPROM. 



Emulator Setup 

1. Refer to page 3-1 and verify that proper grounding and 
power requirements have been met. 

2. Remove the front cover of the Emulator by turning the 
thumbscrews counterclockwise. The pod and LSA pod 
may need to be unplugged in order to do this. 

3. Verify that the main control board and the memory 
control board are in the top two slots of the Emulator 
chassis. (See page 3-4 for board positions.) 

4. Verify that the trace/break board is in the third bus slot 
of the Emulator chassis. (See page 3-4 for board 
positions.) 
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5. If you are using overlay memory, verify that the RAM 
overlay master, and/or master and slave boards, if 
needed, are inserted. (See page 3-4 for board positions.) 

6. Verify that the correct Emulator board for your target 
microprocessor is in the bottom slot. (See page 3-4 for 
board positions.) 

7. Verify that all boards are firmly seated in their 
motherboard connectors. (See page 3-4 for board 
positions.) 

8. Set the thumbwheel switch on the main control board for 
your particular system variables (see page 3-4 for 
thumbwheel switch location). 

System default variables in switch position are: 



- 9600 baud 




- 8- bit word length 


- One stop bit 




- No parity 


- Full duplex 




- No echo 


- Terminal control 




- XON and XOFF are recognized 


- 8th data 


bit 


set to (space) 



9. Verify that the three-position toggle switch on the 
memory control board is in the center position. See page 
3-4 for location illustration. 

10. Replace front panel and attach the correct pod assembly 
(see page 3-8). A pod assembly must be connected to the 
Emulator even if you connecting it to a target system. 

1 1 . OPTIONAL: Connect logic state analyzer pod (see page 
3-9, LSA). 

12. Verify that the RS232C cable connections are correct for 
the system configuration you plan to use (see page 3-10, 
Pin Configurations). (See page 2-3, System 
Configuration.) 
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13. Verify that the RS232C baud rates and data requirements 
are set the same on both the Emulator and the terminal. 
See page 3-5 for thumbwheel switch settings. 

14. If using communications without a modem, you may need 
a null modem cable. If you purchase a null modem cable, 
it is likely to have the following configuration. 



1 

2 
3 
4 
5 
6 
8 
20 
7 



^X 



I 



1 

2 

3 

4 

5 

6* 

8* 

20* 

7 



Check the specifications in your terminal manual before 
reversing the pins. 

*Note that pins 6, 8, and 20 are not used, and are 
unaffected by the cable configuration. 
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System Configuration 

STAND ALONE ENVIRONMENT 

Connect the terminal port of the Emulator to a terminal, using a null 
modem RS232 cable. Insure that the Emulator and terminal are using the 
same baud rate and data lengths (see page 3-5). 

HOSTED ENVIRONMENT 

Connect the terminal port of the Emulator to a terminal. 

Connect the computer port of the Emulator to the host system. (See page 
3-7). 

HOSTED SOFTWARE ENVIRONMENT 

Initial configuration of the Emulator requires that the Emulator terminal 
port be connected to a terminal. Insure that the thumbwheel switch and 
the three-position toggle switch are set to and center, respectively. (See 
page 3-4.) Power-up the Emulator. Configure the Emulator to meet the 
host requirements (see SET menu, page 5-3). After you h ave confi gured 
the Emulator, type SAVE;SET 1,1;SAVE, followed by a |return| . This 



saves the new configuration. After the prompt is returned (this may 
take up to four minutes), power-down the Emulator. Set the thumbwheel 
switch to position 3 (see page 3-4). Connect the computer port of the 
Emulator to the host system (see page 3-7). 
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Target System Setup 

Check that the target has a lead-less chip carrier (LCC) socket. If this 
socket is not present, refer to page x for more information. 

1 . Turn off target system power and Emulator power. 

2. Remove the probe tip protector and save for later use. 
(See page 3-14 for probe tip precautions.) Plug in the 
probe tip. 

3. Check that a good ground exists at the microprocessor 
socket using an ohmmeter. Measure from pin 9, 35, and 
60 to power supply ground on the target board. 

4. Turn on target power. 

5. Validate power supply at the microprocessor socket in the 
target. Use a voltmeter and measure from pin 30 and 62 
to ground (pins 9, 35, or 60). 

6. Check for a valid clock signal at the target microprocessor 
socket (pin 31). 
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Power-Up Sequence 

TARGET SYSTEM PRESENT 

1. Turn on the Emulator. 

2. Turn on the target system. 

3. Reset the target system (see page 6-29). 

NO TARGET SYSTEM 

1. Verity that the pod is connected to the Emulator (see 
page 3-8). 

2. Remove the conductive probe tip protector. Save for 
later use. 

3. Power-up the Emulator. 

4. The power-up banner should be displayed. Select the 
internal clock source. 

When you power-up the Emulator, all registers, maps, event clauses, and 
system variables are either cleared or set to default values. Examine the 
SET and ON menus (see pages 5-3 and 5-9) and configure the system to 
your liking. Your special setup can J:hen be stored in EEPROM (see page 
5-36). By setting the rotary switch on the controller board to the proper 
position, your set-up can be autoloaded on power-up (see page 3-4). 

The ESI 800 Emulator system is now running and ready to accept ES 
Language commands. 
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Test Run of System 

Use this test guide after the system configuration is correct and the ES 
prompt is displayed ( )• 

A system test run consists of the following 9 steps: 

1 . Initialize Emulator. 

2. Map overlay memory. 

3. Test overlay memory. 

4. Enter a program. 

5. Verify a program. 

6. Run the Emulator. 

7. Stop the program. 

8. Display the trace buffer. 

9. Set a breakpoint. 

This test requires an optional overlay memory board. This demonstration 
does not need a target system. 

If you suspect trouble with the ESI 800 hardware, call the Applied 
Microsystems Corporation Customer Service hotline at 1-800-426-3925 
for assistance. 

1. INITIALIZE THE EMULATOR 

Enter the following to initialize the Emulator: 



>SET 1,0;SAV;SET 1,1;SAV;SET 1,0 



This will save any changes you have made to the six categories of variables, 
which include the SET menu (see page 5-3). This operation can take up to 
four minutes if major changes have been made. 
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Do not interrupt the operation. 



2. MAP OVERLAY MEMORY 

Map all of the overlay memory available to the Emulator. Use either of the 
following procedures: 



>MAP TO XXXX 



(Where XXXX is the ending address (in hex) of the amount of overlay 
memory installed.) The following table provides a quick reference for hex 
values corresponding to overlay memory sizes: 



Hex value 


Over 


'Lay memory 


7FFF 




32K 


OFFFF 




64K 


1FFFF 




128K 


3FFFF 




256K 


7FFFF 




51 2K 



For example, to map 64k, enter: 



>MAP to OFFFF Map memory 

>DM Display memory 



A shortcut method is as follows: 



>MAP TO -1 



The shortcut will cause an error message, but it maps all overlay memory. 
For more information, refer to page 5-66. 
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3. TEST OVERLAY MEMORY 

Test all overlay memory installed by entering: 



>SF 1,0 to xxxx 



(Where XXXX is the ending address (in hex) of the amount of overlay 
memory installed.) If there is a failure, repeat mapping and testing. 

For more information, refer to diagnostic functions, page 6-64. 



4. ENTER PROGRAM 

Enter a short program by invoking the line assembler and entering 80286 
op codes (see page 6-44). 



>ASM 10 
**** 80286 LINE ASSEMBLER VX.XLA **** 
CSEG = XXXX 

001ON0P 

001 1>/ 

001 2>/ 

001 3>/ 

001 4>/ 

0015>JMP 10 

001 7>X 



NOP is a null operation. Each time you type the slash ( \J\ ), you repeat the 
previous command, so you have entered the equivalent of five lines of 
NOPs. The [x] at the end exits the assembler. 

5. VERIFY THE PROGRAM 

Single step through the program to verify that it works, by entering: 



2-9 



ES1800 Emulator Reference Manual for the 80286 Microprocessor 



>CS = 

>IP=10 

>STP;DT 

>/ 

>/ 

>/ 

>/ 

>/ 



The disassembled trace should show that NOPs were executed and that the 
jump was taken correctly. 

For more information on the STP command, refer to page 6-23. 



6. RUN THE EMULATOR 
Enter RUN. 




The [|>] prompt should be displayed with no error messages. This indicates 
the Emulator is running in real time, executing the program. 

7. STOP THE PROGRAM 

Enter STP to stop. 



R>STP 



The Emulator should stop running and display the CS:IP register value and 
group 1. The CS:IP value should not exceed 15. 
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8. DISPLAY THE TRACE BUFFER 

Enter DRT to display the execution history of the program. 



>DRT 



The display should show sequence numbers between and 20, and address 
values between 10 and 30. 



>DTB 



This should show a disassembled trace of the program with NOPs and JMP 
10s. 



9. SET A BREAKPOINT 

Verify that the Event Monitor System halts execution when a defined 
condition is met by setting a breakpoint. In this case, the Emulator 
executes 100 (hex) bus cycles, then breaks. 

Enter: 



>WHEN DC1 THEN CNT 

>WHEN CL THEN BRK 

>J>Clg0XXXX 
^CL=1(30> CTL'/^O 
*->RBK- 
R> 



This causes the counter to be incremented each time data comparator 1 
sees a data bus value between 00000 and 0FFFF. When the count limit of 
100 is reached, emulation breaks. 
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If a break does not occur: 

1. EnteraSTP. 

2. Set CS and IP to and 10. 

3. Enter DES 1 and verify that you have entered the 
WHEN/THEN statement and comparator values as shown 
above. 

4. Type RBK again. 

If no break occurs call Applied Microsystems Customer Service at 
1-800-426-3925 for assistance. 
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Emulator Chassis Assembly 

The Emulator chassis is the metal enclosure housing the control boards for 
the target system. This rack-mountable chassis houses up to six boards as 
shown in the figure on page 3-4. 

The Emulator power supply is also in this chassis. A power switch on the 
rear panel is the only external panel control. 

WARNING! 
A cooling fan and vent for the Emulator are located on the left 
side panel of the chassis. The warm air exhaust vent is in the 
right side panel. Blocking either of these panels may cause the 
Emulator to overheat. 

SYSTEM GROUNDS 

The ESI 800 Emulator has three grounding systems: 

1. A chassis ground from the metallic enclosure of the unit 
to the power filter. 

2. An AC protective ground from the green ground wire of 
the AC power cord and the chassis ground at the power 
filter. 
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A signal ground connected by means of a jumper at the 
power supply terminal strip to the chassis ground. The 
Emulator has a three-wire power cord with a three- 
terminal polarized plug. The ground terminal of the plug 
is connected internally to the metal chassis parts of the 
Emulator. 

WARNING! 

Failure to ground the system properly may create 
a shock hazard. 
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Emulator Control Boards 

Removing the front panel of the Emulator chassis exposes the chassis card 
cage as shown in Figure 2 on the following page. Open this panel by 
turning the two knobs in the upper corners of the front panel 
counterclockwise. 



Main Control Board 



Memory Control Board 



Trace /Break Board 



Overlay Memory 
Board(s) 



Emulation Board 



The main control board holds the 
controlling 6809 CPU for the Emulator, the 
EEPROM, two serial ports, and RAM. The 
16-position thumbwheel switch on this 
board determines the system variables and 
serial line baud rates for autoloading on 
power-up. Refer to page 3-5 for each 
switch position setup. Switch position 
autoloads default system variables. 

The memory control board holds the 
memory management logic and optional 
symbolic memory. The three-position 
toggle switch below the main control board 
thumbwheel switch must be in the center 
position. If the toggle switch is in either of 
the other two positions, the Emulator will 
not work properly. 

The trace/break board holds trace memory, 
the Event Monitor System, and the logic 
state analyzer (LSA) interface. 

The overlay memory board set is optional 
and can hold 32K, 64K, 128K, 256K or 
512K of memory. (512K of memory 
requires a slave board.) 

There are six different emulation boards, 
depending on the target microprocessor you 
are using. (Refer to the diagram on the 
following page for the location of the label 
indicating the processor type.) 
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Figure 2. Control Boards 



THUMBWHEEL SWITCH 



MCB TOGGLE SWITCH 



COOLING FAN 




POD CONNECTOR OPENING 



LSA POD CONNECTOR OPENING 



FRONT PANEL RELEASE KNOBS 



COOLING VENTS 
RAM OVERLAY BOARD 
TRACE/BREAK BOARD 
MEMORY CONTROL BOARD 
EMULATION BOARD 
MAIN CONTROL BOARD 
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Emulation Board 
Thumbwheel Switch Settings 



SITION 


PARAMETERS 


BAUD RATE 





Factory Default* 


9,600 


1 


User "0" defined 


User defined 
Terminal control 


2 


User "1" defined 


User defined 
Terminal control 


3 


User "0" defined 


User defined 
Computer control 


4 


User "1" defined 


User defined 
Computer control 


5 


Factory Default* 


110 


6 


Factory Default* 


300 


7 


Factory Default* 


1,200 


8 


Factory Default* 


2,400 


9 


Factory Default* 


4,800 


A 


Factory Default* 


7,200 


B 


Factory Default* 


19,200 



C,D,E,F Reserved for factory use 



♦Factory Default Parameters 

- 8- bit word length 

- no parity 

- Terminal control 
no echo 



- one stop bit 

- full duplex 

- XON and XOFF are recognized 

- baud rate the same for both terminals 

- 8th data bit set to (space) 
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Emulator Chassis Rear Panel 

The rear panel of the Emulator mainframe is shown in Figure 3 on page 

3-7. 



Serial Ports 



Trigger Output 



The two serial ports are RS 232C ports 
labeled Iterminal] and [computer]. Pins are 
discussed on page 3-10. 

System configuration determines which 
port your peripheral equipment connects to 
(see pages 1-4 and 2-4). 

The ESI 800 Emulator provides a TTL 
trigger strobe output controlled by the 
Event Monitor System. The trigger output 
is available at a BNC connector on the rear 
panel of the chassis and on a clip lead 
attached to the optional logic state analyzer 
(LSA) pod. Refer to Section 7 for 
information on Event Monitor System 
actions. 

The trigger can be used for such things as: 

■Synchronizing an 
oscilloscope to the execution 
of an I/O routine. 

■ Measuring the duration of a 
routine by asserting the 
trigger for its duration and 
using a timer-counter. 

■ Cross-coupling two or more 
Emulators so that an event 
in one can control events in 
the others. 
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Power Switch 



Line Fuse 



Before powering up, two items should be 
checked: 

1. Proper grounding of power cable 
(see page 3-1). 

2. Proper power-up sequence of 
Emulator, target system, and/or 
peripheral equipment. (See Power- 
Up, page 2-6.) 

A 3 amp slow-blow fuse for 110V operation 
or a 1.5 amp slow-blow fuse for 220V 
operations. Remove the fuse by turning the 
fuse holder counter clockwise. 



Figure 3. Rear Panel 



© 



o (p.v.v.v.v.v.v> )o ™ 



o [iCv.v.v.v.%;v^ ) q computer 

© [ dp] Q 




115V/230V SWITCH 
UNE FUSE 




AC POWER CONNECTION 
TRIGGER OUTPUT 

POWER SWITCH 
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Pod Assembly 

The pod assembly is the link between the ESI 800 Emulator and the target 
system. A 40-inch ribbon cable assembly connects the pod assembly to the 
Emulator board. An 11 -inch ribbon cable assembly ends in a probe tip 
that is inserted into the microprocessor socket in the target system. 

Figure 4. Pod Assembly 



EP-80286 





tillll'"!'!!' 




With the pod assembly is a set of jumpers (J5 and J6) that lets the CPU 
send status lines S0~ and Sl~ to the target either buffered or unbuffered. 
J5 and J6 come set to buffered mode for shipping. C/rcbuffered, the 
ESI 800 sends S0~ and Sl~ three to five ns faster. 

To change the jumpers to unbuffered mode: (1) Disconnect the power. (2) 
Disconnect the pod probe tip from the target. (3) Remove the four screws 
from the bottom of the pod case. (4) Remove the bottom PC cover and 
board. (5) J5 and J6 are on the top board next to the probe tip interface 
board, and are set to pins 1-2. Set J5 and J6 to pins 2-3. (Pin 3 is the one 
closest to the 150-pin DIN connector.) 
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Logic State Analyzer (LSA) Assembly 

An optional feature, the logic state analyzer (LSA) pod assembly connects 
directly above the Emulator pod assembly. The LSA assembly includes a 
pod, cables, and probe clips. The LSA pod provides 16 input lines and one 
trigger output line,, 

The one trigger output line behaves the same as the BNC signal on the rear 
panel of the Emulator and can be used with an oscilloscope. 

Figure 5. Logic State Analyzer Pod Assembly 
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Serial Ports 

Both the terminal port ( [terminal]) and the computer port ( [computer I ) end in 
standard RS232C female connectors. Make sure peripheral hardware is 
connected to the correct port. 

Baud Rate Baud rates and data lengths for each port 

are independent. Refer to the SET 
command (page 5-3) for available baud 
rates on each port. 

Port Control Only one port can be the controlling port. 

Either port can give control to the other 
port. (See pages 5-39, 5-43, and 5-44.) 

Upload /Download The Emulator accepts commands to begin 

uploading/downloading from either port. 
However, the Emulator uploads/downloads 
hex format data files only through the 
computer port. 

Your system configuration determines which port should be in control. 
Refer to pages 1-4 and 3-5. 

PIN CONFIGURATIONS 

The pin configuration of your equipment (terminal, PC or host) may not 
match that of the Emulator. It is important to be familiar with the pin 
configurations of all peripheral equipment you intend to use with the 
ESI 800 Emulator. 

The ESI 800 Emulator is configured as "Data Terminal Equipment" (DTE). 
Before powering up, make sure the ESI 800 Emulator system and 
peripheral hardware are compatible. Pins 1, 2, 3 and 7 must be connected 
to peripheral hardware. Pins 4 and 5 need to be connected if peripherals 
attached to the Emulator use these pins. This situation may require a null 
modem cable with pins 2 and 3 (and pins 4 and 5) crossed. 

Both ports use the same pin assignment. All pin assignments and voltage 
levels conform to Electronics Industries Association RS232C standards. 
The following chart lists the signals on each pin. 
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Pin 



Name 



Description 



Protective Ground 



Serial Data Out 



Serial Data In 



Request to Send (Output) 



Clear to Send (Input) 



6 Not Used 

7 Signal Ground 

8-25 Not Used 



Connected in the Emulator to 
logic ground. 

This signal is driven to nominal 
±12 voltage levels by an RS232C 
compatible driver. 

Data is accepted on this pin if the 
voltage levels (±12V) are as 
specified by RS232C 
specifications. 

This signal is driven to nominal 
±12V levels by an RS232C 
compatible driver. It signals other 
equipment that the Emulator is 
ready to accept data at this port. 

An input signal to the Emulator 
indicates that another piece of 
equipment in the system is ready 
to accept data. This signal is 
terminated so the Emulator 
operates with the signal 
disconnected. 



Connected in the Emulator to the 
system logic ground. 

These pins are not used by the 
ESI 800 Emulator, but may be 
required by your peripheral 
hardware. 
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DATA REQUIREMENTS 



Stop Bits 



Parity 



Hardware Handshake 



Software Handshake 
XON XOFF 



The Emulator software transmits and 
receives 8-bit ASCII characters. The 
number of stop bits is determined by SET 
parameter #11 for the |terminal| port and 
#21 for the Icompute rI port (see page 5-3). 

The Emulator sends and checks parity 
according to system SET parameter #12 for 
the terminal port and #22 for the computer 
port. These two SET parameters are listed 
on the SET menu (page 5-3). 

Each character consists of a start bit 
followed by 8 data bits. When no data is 
being transmitted, the serial data out pin 
(pin #2) will be at the 12V level. 

When the Emulator is ready to receive data, 
it asserts the Request To Send line (pin #4). 
When a receive buffer is nearly full, the 
Emulator deasserts the Request To Send 
line. 

When the Emulator is ready to transmit 
data, it checks the status of the Clear To 
Send line (pin #5). Data is transmitted only 
when Clear To Send is high. 

The ESI 800 uses normal flow control codes 
to control software handshaking. The 
default values are XON (CTRL Q) and 
XOFF (CTRL S). You can change these 
values (see page 5-3). 

The ESI 800 serial 1/0 system contains 
internal buffers to smooth the transmission 
of data via the serial ports. If an input 
buffer becomes nearly full, the system 
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immediately transmits an XOFF character. 
When the software empties the input 
buffer, the system transmits an XON 
character. 

Although the user cannot overfill the input 
buffer from a controlling terminal, a 
controlling computer is quite capable of 
doing so. The input buffer for the 
computer port is 64 characters deep. When 
eight characters have been placed in the 
computer input buffer, the XOFF character 
is transmitted. Allowing two character 
times for skew, the computer must transmit 
no more than 54 characters until the next 
XON from the ESI 800. 

The RTS hardware handshake follows the 
software handshake described above. When 
an XOFF is transmitted, RTS is dropped on 
that I/O port; when an XON is transmitted, 
RTS is reasserted. 
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Maintenance 

Maintenance of the ES1800 Emulator has been minimized by the extensive 
use of solid-state components throughout the instrument. There are only 
three areas where you need be concerned. 

CABLES 

The interconnect cables are the most vulnerable part of the instrument, 
due to constant flexing during insertion and extraction. First, inspect the 
cables for any obvious damage, such as cuts, breaks, or tears. Even if you 
have thoroughly inspected the cables and cannot find any damage, there 
may be broken wires within the cables (usually located close to the ends). 
A broken wire within the cable will cause the instrument to run erratically 
or intermittently if the cables are flexed during emulation (run mode). By 
swapping the cables in question with a known good set of cables, you can 
easily isolate the faulty cable. 

PROBE TIP ASSEMBLY 

The probe tip assembly consists of a ceramic lead-less chip, four ribbon 
cables and an adapter board. The adapter board is inside the pod case. 
When the Emulator is not in use, the protective cover should be installed 
over the ceramic chip to prevent cable abrasion and to protect it from being 
damaged by other objects. Folding or kinking of the ribbon cables may 
result in premature failure. 
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CLEANING THE FAN FILTER 

The fan filter should be cleaned regularly. The recommended interval is 
every 90 days. If you are working in a dusty environment, you may need to 
clean the filter more frequently. 

1. Unplug the ES 1800. 

WARNING! 

Electrical shock and moving fan parts are 
dangerous. Make sure you unplug the unit 
before proceeding. 

2. Remove the front cover of the ES 1800. (Loosen the two 
captive fasteners.) 

3. Remove the top cover of the ES 1800. (Unscrew six 
screws and lift the cover off.) 
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4. Unscrew the two screws at the top of the chassis which 
hold the fan in place. 

ES 1800 Fan Mounting 




FAN 
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5. Tilt the fan towards the boards in the chassis. 
ES 1800 With Fan Tilted for Easy Access to Filter 



FAN FILTER 




6. Remove the fan filter. 

7. Rinse the fan filter in cold water. Thoroughly shake out 
the excess water. 

8. Replace the fan filter. 

9. Tilt the fan back into the correct position. 

10. Replace the screws connecting the top of the chassis to 
the fan. 

1 1. Replace the top and front covers. 



3-17 



ES 1800 Emulator Reference Manual for 80286 Series Microprocessors 

PARTS 

The following parts are available for you to order: 



Probe tip assembly 
Long cable set 
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Troubleshooting 

Check that the interconnect cables are installed properly in a compatible 
target system, with power applied to both the target system and the 
Emulator before starting troubleshooting procedures. 

The most common problems encountered are listed below. We 
recommend that you contact Customer Service at Applied Microsystems 
Corporation if you experience any problems that do not fall within this 
range of items. Before you call our service department, display your 
software revision number by typing REV (page 5-126). Also, record the 
serial number on the back of the chassis. You will be asked for the revision 
number and serial number when you call. 

We do not recommend a component-level repair in the field, unless performed 
by a qualified service engineer. 







Troubleshooting 


SYMPTOM 


POSSIBLE CAUSES 


Target system 


1. 


Faulty interconnect cables 


runs erratically 








2. 


Broken ceramic probe tip 




3. 


Poor seating of probe tip assembly 




4. 


LDV not executed before RUN (vector not loaded). 


Emulator wi U 


1. 


Baud rate set incorrectly. 


not communicate 






over RS232 


2. 


Target system requires "null" modem 
cable (pin 2 and pin 3 of RS232 connector 
reversed). 




3. 


Emulator configuration incorrect. 
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ES 1800 Emulator Specifications 

INPUT POWER 



Standard 



Optional 



90 to 130 VAC 

47 to 60 Hz 

consumption less than 130W 

180 to 260 VAC 

47 to 50 Hz 

consumption less than 130W 



ENVIRONMENTAL 



Operating Temperature 
Storage Temperature 
Humidity 



°C to 40 °C (32 °F to 104 °F) 

-40 °C to 70 °C (-40 °F to 158 °F) 

5% to 95% relative humidity, non- 
condensing 



PHYSICAL 

Mainframe 

Emulator Pod 



13.2 cm x 43.18 cm. x 34.29 cm. 
(6.2 in. x 17 in. x 13.5 in) 

22.6 cm. x 12.9 cm. x 4.1 cm. 
(8.9 in. x 5.1 in. x 1.6 in.) 
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Target System 1.5 m (60 inches) 
Connection (total 
length including pod) 

LSA Pod VIA cm. x 7.9 cm. x 2.3 cm. 

(4.9 inc. x 3.1 in. x .9 in.) 

Total Weight 9.1 kg. (20 lbs.) 

Shipping 10.9 kg. (24 lbs.) 
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ES LANGUAGE 



Structure of the ES Language 

The command language that controls the ESI 800 Emulator is a formal 
language. Once you understand the basic concepts of this language, you 
can apply the full debugging power of the Emulator. An overview of the 
ES language structure is presented in the accompanying table. A more 
detailed description of the language elements, the help menu, prompts, 
special operating modes, and ES language error messages are also included 
in this section. Items in angle brackets ( EE ) are mandatory and must be 
entered as part of the command. 

Items shown in square brackets ( [nj ) are optional. Do not type the angle 
or square brackets when typing a command. 

If the ESL command interpreter detects an illegal statement, it beeps and 
places a question mark under the command line near the position the error 
was detected. Enter a [?] following an error to display the appropriate error 
message. 
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ES Language Syntax 



Language Element 



Example 



Command Line 

[Repeat] Command Statement [;Command Statement] ... <RETURN> 
Single Character Instant Command 



Repeat 



<*><Repeat limit> 
Repeat Limit: 



32 



*STP;DT 
*9 STP;DT 

87651234 



Decimal number only (1 to 2 -1) 

Command Statement 

Command Mnemonic 

Command Mnemonic <Expression> 

Command Mnemonic <Expression List> 

Assignment Command 

Expression 

Event Monitor System Control Statement 

Single Character Instant Command 

</> (repeat previous command line) 

< ( > (execute macro 1 or decrement scroll in memory mode) 
<.> (execute macro 2 or increment scroll in memory mode) 
<?> (help) 

Command Mnemonic 

<1 or more alpha characters>[l or more decimal characters] ASM 



DTB 

MM CS-.IP + 4 

SET #20 ,#14 

CS = 0FA9 

2 * GR5 

WHEN AC1 THEN BRK 



Expression 

[Unary Operator] lvalue 
lvalue <Operator> Expression 
<@> Expression 
<(> Expression <)> 
Nvalue <:> Nvalue 



-2473 

2 - 3F6C90 

S)240;aaasS:SP 

2 * (-2 + 3) 

CS:1234 
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ES Language Syntax (cont) 



Language Element 


Example 


lvalue: 




Symbol 


1 ma i n 


Nvalue 




Symbol: 




<*><1 or more printable charactersxspace or return> 


Nvalue: 




Number 


7FA36 


Register Name 


IP 


Register Name: 




<1 - 3 Alpha characters>[0 - 2 decimal 


digits] 


Number: 




[Base]<l or more digits> 


%0101001 


Base: 




<%> (binary) 




<\> (octal) 




<#> (decimal) 




<$> (hexadecimal) 




Expression List 




Expression <,> Expression [.Expression list]... 


1,CS:IP f 2+2,-6 


Assignment Command 




Svalue <=> Expression 


IP = aOFFFFO 


<@> Expression <=> Expression 


aSS:SP = CS:IP 


Svalue: 




Symbol 


■Test_result 


Register Name 


MMP 
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ES Language Syntax (cont) 



Language Element 



Example 



Event Monitor System Control Statement 

[Group] <WHE[N]> Event <THE[N]> Action List 



Group: 



<1> 
<2> 
<3> 
<4> 



Event: 



[Disjunctive] <Event Comparator> 
Event <Conjunctive> <Event> 

Disjunctive: 

<NOT> 

Event Comparator 

<ACl>[.Group] 
<AC2>[.Group] 
<DCl>[.Group] 
<DC2>[.Group] 
<Sl>[.Group] 
<S2>[. Group] 
<CTL>[. Group] 
<LSA>[. Group] 

Conjunctive: 

<AND> 
<OR> 

Action List 

<Action>[,Action] . . . 



WHEN AC1 THEN BRK 



2 WHE AC1 THE BRK 



NOT AC1 

DC2 OR NOT AC1 



AC1.3 



CTL.4 



TRC,TGR,FSI 
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ES Language Syntax (cont) 



Language Element 


Example 


Action: 




<BRK> 




<TRC> 




<TOT> 




<CNT> 




<TOC> 




<RCT> 




<TGR> 




<FSI> 




<GRO Group> 


GRO 3 


Unary Operator 




<ABS> 


ABS GD3 


<!> 


!0AA 


<-> 


-3 


Operator 




Mul.op 




Add. op 




Shft.op 




<&> 


GD4 & OFF 


<*> 


DC2.3 A OFF00 


Mul.Op 




<*> 


2*3 


</> 


OFAC / %01001 


<MOD> 


GD5 MOD 7 


Add. op 




<+> 


GRO + IP 


<-> 


a(SS:SP - 4) 


Shft.op 




<«> 


DC1 « 3 


<>» 
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Notes on ESL 

Command Line 



Repeat 



Command Statement 



A command line is created by entering one 
or more characters after the ESL prompt 
(see page 4-24 for a description of the 
various prompts). One or more command 
statements can be placed on a single 
command line. Multiple command 
statements must be separated by a 
semicolon. The command line is limited to 
76 characters and must be terminated with a 
return. The only way to extend command 
lines is by using macros (see page 5-105). 

Backspace or delete characters may be used 
to delete the previous character entered on a 
command line. CTRL X deletes the entire 
line. CTRL R redisplays the current line 
(useful for hardcopy terminals). 

If an asterisk (0) is the first character on 
the command line, the entire command line 
will be repeated indefinitely. If the asterisk 
is followed immediately by a decimal 
number, the command will be executed that 
many times. A repeating command line 
may also be terminated by setting the TST 
register to zero within the command line. 
This allows you to repeat something until a 
condition is met. 

There are several special modes in which 
the above command statement rules do not 
apply. In memory mode (see page 6-52) 
entering a |RETUR N~lon an empty line causes 
the next location to be read. Entering a 
value followed by [return] will cause that 
value to be written to memory. I/O mode 
(page 6-52), the line assembler (see page 
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6-44), memory disassembler (page 6-50), 
and main help menu (page 4-19) all have 
special modes that alter the normal 
execution of ESL commands. 



Single Character 
Instant Commands 



These commands are processed immediately 
when they are the first character entered on 
a command line. The forward slash 
character ( ) causes the previously 
entered command line to be repeated. 




This command single steps three times. 

The comma ( Q ) executes macro 1 , and the 
period ( □ ) executes macro 2. However, if 
you are in memory or I/O mode, the period 
moves you to the next higher memory 
address, while the comma moves you to the 
next lower address. 

The question mark ( \t\ ) also has two uses. 
It can be entered after the command 
interpreter detects an error and beeps. If 
you are "beeped," enter a and the 
command processor will give you an error 
message describing the problem it detected. 

A entered at any other time (i.e., not after 
an error), causes a two-page Help Menu to 
be displayed. A IreturnI moves you from 
the first page to the second. Any other 
character terminates the Help Menu. 
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Command Mnemonics 



Command mnemonics are the alpha- 
numeric character strings that identify a 
specific ESL command. Command 

mnemonics are formed from 1 to 3 alpha 
characters followed by to 2 numeric 
characters. Extra characters in between are 
ignored. For example, 



WHEN 



is the same as 
IwheI and |gri 23451 is the same as IGR45I . See the 
Appendices for a list of all ES language 
mnemonics. 



Expression 



An expression can be an integer value, an 
alpha/numeric value, or an equation. 

Parentheses may be used to alter the normal 
precedence of operations. The Emulator 
recognizes parentheses just as they are 
treated in algebraic equations. You can use 
as many levels of parentheses as you need. 
The only limitation is that statements can be 
no more than 76 characters long. 

Parentheses are not allowed in 
WHEN/THEN clauses. Parentheses are also 
not allowed in conjunction with the colon 
operator (when used as an address 
expression operator). 

The expression processor can resolve 
arbitrarily complex expressions. 



3<GD0 +3) = IP + #100 * <DX » 4) +0AF34 



This example retrieves the value of the DX 
register, shifts it right 4 bit positions 
(divide by 2^), multiplies the result by 100 
decimal, adds 0AF34 and the contents of 
the IP register, and writes the result to the 
location 3 bytes above the address in GD0. 
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A more common and useful example might 
be: 



ASM CS:IP 



This computes the address CS:IP and starts 
up the line assembler at that address. The 
expression: 



Interrupt + 1A6 



by itself will add 1A6 to the current value 
of the symbol, Interrupt, and display the 
result. If you do not assign the results of an 
expression to a location or register, the 
result is displayed as a 32-bit value. 

The [a] operator is an indirection operator. 
la Ex pi (where IexpI is an expression) refers to 
the value in memory at the address |xp]. If 
the |a Exp| is on the left side of an [=] then the 
value from the right side of the g will be 
loaded into memory at the address Hxg. At 



all other times, la expI simply reads a value 



from memory. |ass:SP| is a simple way to 
read something from the stack pointer. In 
physical mode (see page 6-4) it is legal to 
have multiple indirections, e.g., 
laaGRO = aaa(ss:SP + 6)| . Byte mode and word 
mode affect the length of data transferred 
to or from the target by the [a] operator. 

In physical mode (see page 6-4) the colon 
operator (0) mimics the arithmetic 
combination of segment and pointer 
registers in the 8086 microprocessor. The 
value on the left side of the colon is shifted 
left 4 bits, added to the value on the right 
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side and, finally, the total is masked to 20 
bits. In virtual mode the expression 



16 bit value: 16 bit value 



is interpreted as 



selectonoffset 



The colon operator is handled at the 
preprocessor level and thus has higher 
precedence than normal math operators. 
The colon operator must be used only 
between actual numbers or register names; 
e.g., |cs:ip| is fine but |cs:(ip+3)| is illegal. 



All other math or logic operations are 
evaluated according to the order given in 
the following section on operators. 
Parentheses may be used to alter the normal 
precedence. Unary operations must be 
enclosed in parentheses if they occur within 
another expression; e.g., |2+-1| is illegal, but 
|2+(-DI and 1-1+21 are legal. 



Certain combinations of expression types 
and operators are illegal or have complex 
results. See Results of Dyadic Operator 
Combinations table on page 4-19. 

Some commands can accept a variety of 
argument types. The display block (DB) 
command accepts an integer, a range, or no 
argument at all. Other commands require 
that a certain argument type be used. The 
upload (UPL) command requires a range 
argument. See the discussion on Numbers, 
below, for types. 
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Symbols 



Numbers 



If the symbolic debug option is installed in 
the ESI 800 Emulator, you can use symbolic 
references. Every symbol must begin with 
a single quote ( Q ). Symbols are composed 
of 1 to 64 printable characters followed by a 
space or [return! . Symbols can be used 
anywhere a register or a number is used, 
with the exceptions that symbols are not 
valid with the colon ( [7] ) operator or the 
repeat ( ) operator. 

The ESI 800 has a default base register. It is 
assumed that numbers entered without a 
leading base character are being entered in 
the default base. Generally, the default 
base is hexadecimal (factory default). See 
page 5-83 for more information on 
changing the default base register. 

There are three different types of numbers. 

■ An integer is a 32-bit signed 
value. 

■ A don't care is a 32-bit 
value with a 32-bit mask. 
For each bit set in the mask, 
the corresponding bit 
position in the value is 
ignored during Event 
Monitor comparisons. Don't 
cares can be entered in two 
ways. 



1234 DC OfTo] is 



ex plicit. I1XX4I is equivalent 
to I1FF4 dc offoI . Don't cares 
are useful for setting the 
Event Monitor System event 
comparators (see page 7-2). 

A range is specified by 
entering a start address and 
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Base 



a length or an endpoint. 
200 len 2d] is the same as 
1200 to 21 f I. Ranges can be 
either internal (default) or 
external. An explicit range 
type can be specified by 
using the prefix IRA or 
XRA. [0 len 1001 is the same 
as |ira o len 100| . The Q] 
operator inverts the type of 
a range value. I ■ co len 100)J 



is the same as Ixra o len Too 



which means everything but 
addresses 1 to 00FF. The 
endpoints are always 
included in the range. 
Regardless of the method of 
entering (TO, LEN), range 
values are always displayed 
as "start TO end." 

Ranges, don't cares, and integers are not 
generally interchangeable. Certain registers 
can only hold certain data types. All 
registers can hold integers. Address type 
registers cannot be loaded with don't care 
values. Status and data registers cannot be 
loaded with range values. See page 5-75 for 
a list of all registers and their data types. 

To enter a character in any base other than 
the default, use a leading base character: [%j 
= binary, = octal, [#I = decimal, and [$] = 
hexadecimal. 



Expression List 



Lists are required by a few commands. 
They can also be used for implicit 
evaluation. For example, in pause mode, 
entering the three numbers 
%01 001 1010, #128, \77347] causes the Emulator 
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Indirection Operator 



to display their equivalent in the default 
display base (usually hexadecimal). Lists 
are limited to nine elements. Lists are used 
in memory and I/O modes as well. 



In 



physical mo de, the form 
^Expression = Expression! will cause the left 
side expression to be calculated and used as 
an address at which to store the value of the 
right side expression. Note that since 
itself an expression, in 
commands such as 



|aExpression| is 

physical mode, 

|aass:sp = ol are legal and useful 



Parentheses may be used to affect the 
processing of the [a] operator: 



>a GD4 + 6 
>3 (GD4 + 6) 



In the first example the indirection operator 
is applied to [gd4]. The command interpreter 
accesses the target system location pointed 
at by [gd4J, adds six to the value stored there, 
and displays the final results. 

In the second example, the Emulator 
displays the value stored in the sixth 
location above the address pointed to by 



GD4 



Memory mode always executes memory 
reads. This may be unacceptable for certain 
hardware configurations. To store values 
without entering memory mode, use: 



>a <address> = <data> 
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Registers 



Event Monitor System 
Control Statement 



Group 



This causes the system to load data into the 
specified address. 

In physical mode, more than one [aj operator 
in an expression displays a quantity pointed 
to by another quantity located in the target 
system memory. The Emulator evaluates 
the expression following the [a] operators, 
considers it an address, and looks at the 
value stored at this address. The value at 
this address is also considered to be an 
address. This address is accessed and 
displayed. 

Registers are grouped into three types: 
integer only, don't care, and range. Any 
register can be assigned an integer value. 
Don't care registers can be loaded with 
don't care values or integers but not ranges. 
Range registers can be loaded with integers 
or ranges but not: don't care values. See 
page 5-75 for a list of all registers and their 
data types. 

Event Monitor System statements describe 
combinations of target program conditions 
and the corresponding actions to be taken if 
the conditions are met; they do not describe 
mathematical or logical computations. Be 
aware that normal expression operators are 
illegal when specifying Event Monitor 
System statements. These statements are 
discussed in detail in Section 7, Event 
Monitor System. 

The Event Monitor System (EMS) is 
arranged in four independent groups. 
These groups provide a state-machine 
capability for debugging difficult 
problems. An EMS control statement can 
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only be associated with one of the four 
groups. If no group numbers are mentioned 
in the EMS control statement, the statement 
is assigned to group 1 . There are two ways 
to override this default selection of group 1 . 
You can begin the EMS control statement 
with a group number, or you can append a 
group number to any one of the vent 
comparator names. For example: 



3 when AC1 then brk| is functionally the same 
as |when AC1.3 then brk| ; both use group 3. 



You cannot mix group numbers within a 
single EMS control statement. 



Event 



You can define an event to be some 
combination of address, data, status, count 
and logic state probe conditions. Numerous 
Event Monitor System control statements 
can be entered and will be in effect 
simultaneously. Conflicting statements may 
cause unpredictable action processing. 
Parentheses are not allowed in event 
specifications. 



Disjunctive 



The NOT operator is used to reverse the 
sense of the comparator output. NOT has 
higher precedence than either of the 
conjunctives, AND and OR. 



WHEN AC1 AND NOT DC1 THEN BRK 



This statement means break whenever any 
data pattern other than that in DC1 is read 
from or written to the address in AC1 . 
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Conjunctive 



AND and OR can be used where needed to 
form more restrictive event definitions. 
AND terms have higher precedence than 
OR terms. 



AC1 AND DC1 OR DC2 



This event is equivalent to I act and dcT| in 
one statement and [dc2] in another. If you 
are looking for two different data values at 
an address, use: 



AC1 AND DC1 OR AC1 AND DC2 



The OR operator is evaluated left to right 
and is useful for simple comparator 
combinations. For complex event 
specifications, OR combinations can be 
replaced with separate EMS control 
statements for clarity. 



AC1 AND S1 OR AC2 AND S2 



This event is the same as Iaci and si I and 



ac2 and s2| in separate statements. 



Unary Operator 



All internal computations use 32-bit math. 
Values entered with a leading Q are 
converted to signed numbers; e.g., E3 1S 
stored internally as |$ffffffff 1. Internal 



math, however, is signed only for the 0, EL 
0, \J\ operations; 1-5+31 is |$fffffffe| , while 



1-1 » 11 is reduced to |$7fffffff 
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ABS converts a signed number to its 
absolute value. 

is a logical NOT operator and 
compliments all 32 bits of a number. If the 
number is a range, the range type (internal 
or external) is inverted. 

Unary operators have the highest 



precedence. 1-2+31 is 1 



Operator 



The operators are listed below in 
descending order of precedence. Operators 
of the same type are evaluated left to right. 



Mul.op: 
* 

/ 

MOD 


Multiply 

Divide 

Modulo 


Add. op: 

+ 


Add 
Subtract 


Shft.op: 
» 
« 


Right shift 
Left shift 


& 


Logical AND 


A 


Logical OR 



Modulo 



The MOD operator. The result of this 
operation is the remainder after the value 
on the left has been divided by the value on 
the right. 



>29 MOD 4 
result = 1 
>38 MOD 6 
result = 2 
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Results of Single- Argument Operators 



Operator 



Argument 


Result 


Integer 


Valid 


DC 


Don't care bits are not affected. 


IRA 


Complement (IRA becomes XRA) 


Integer 


Valid 


DC 


Don't care bits are not affected. 


IRA 


Invalid 


XRA 


Invalid 


Integer 


Valid 


DC 


Don't care bits are not affected. 


IRA 


Invalid 


XRA 


Invalid 


Integer 


Valid 


DC 


Invalid 


IRA 


Invalid 


XRA 


Invalid 



ABS 



@ 
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Results of Dyadic Operator Combinations 



Left Hand 


Right Hand 






Expression 


Expression 


Operator 


Result 


Integer 


Integer 


* / MOD 


Valid 






&~ 


Valid 






« » 


Valid 






+ - 


Valid 


Integer 


Don't care 


MOD 


Illegal 






*/ 


Don't care bits are passed to 
the left hand argument. 






&" 


Don't care bits are passed to 
the left hand argument. 






« » 


Don't care bits are passed to 
the left hand argument. 


Integer 


IRA XRA 


* /MOD 


Invalid 






&* 


Invalid 






« » 


Invalid 






+ - 


The endpoints of the range will 
be altered by the value of the 
integer expression. 


Don't care 


Don't care 


* /MOD 


Invalid 






<fc~ 


Invalid 






« » 


Invalid 






+ - 


Don't care bits are ANDed. 


Don't care 


Integer 


* /MOD 


Don't care bits are kept. 






&~ 


Valid 






« » 


Don't care bit positions are 
shifted. 






+ - 


Don't care bits are kept. 


IRA, XRA 


Integer 


* /MOD 


Invalid 






&* 


Invalid 






« » 


Invalid 






+ - 


The end points of the range 
will be altered by the value of 
the integer expressed. 
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Help 

There are two pages of help information available. Enter a [?] as the first 
character of a command line to display the first help page, or type HELP. 
This page gives examples of the most commonly used commands and their 
meanings. The second page describes the Event Monitor System registers 
and commands. Enter a | return] at the end of the first page to move to the 
second page. The menus are shown on the next two pages. 



Information on switch settings, configuration settings, and special functions 
is available without using the help menus. Other help menus are described 
below. 



Software Switches 



Enter either [on] or [off] to display the 
current settings and definitions of all 
software switches, (see page 5-9). 



Communications 
Set-up 



Enter [set] to display the current 



configuration settings and possible values 
(see page 5-3). 



Special Diagnostic 
Functions 



Enter \s¥\ to display a list of the available 
special functions (RAM/ROM tests, Scope 
loops, etc.) (see page 6-67). 
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First Page of Help Menu 



>? 

RUN/EMULATION: 
STP - SINGLE STEP/STOP 
RST - RESET TARGET PROCESSOR 

TRACE HISTORY: 
DT - DISASSEMBLE MOST RECENT LINE 



RUN/RNV • RUN/RUN WITH NEW VECTORS 
RBK/RBV - RUN TO BREAKPOINT/WITH VECTORS 
WAIT - WAIT UNTIL EMULATION BREAK 

DTB/DTF -DISASSEMBLE PAGE BACK/ FORWARD 
DRT (X) -DISPLAY PAGE RAW TRACE (FROM X) 



MEMORY - REGISTER COMMANDS: DR/DRL-DISPLAY VIR/PHY MODE CPU REGS 

DB X TO Y - DISPLAY BLOCK FILL X TO Y,Z - FILL BLOCK WITH Z 

BMO X TO Y,Z - BLOCK MOVE TO Z LOV/VFO X TO Y - LOAD/VERIFY OVERLAY 
DRL - DISPLAY REGISTERS IN LONG WORD (VIRTUAL MODE) 
X - EXIT MEMORY MODE M X - VIEW/CHANGE MEMORY AT X 



MEMORY MAPPING: 
MAP X TO Y :RO 



::RW :TGT :ILG 



COMMUNICATIONS: 
DNL - DOWNLOAD HEX FILE FROM HOST 
UPL X TO Y - UPLOAD HEX TO HOST 



DM/CLM - DISPLAY/CLEAR MEMORY MAP 

TRA - TRANSPARENT MODE TERMINAL- HOST 
CCT - TRANSFER CONTROL TO COMPUTER PORT 
TCT - TRANSFER CONTROL TO TERMINAL PORT 



SYSTEM: SET - VIEW/ALTER SYSTEM PARAMETERS 

ON/OFF - VIEW/ALTER SWITCHES SF - VIEW/EXECUTE SPECIAL FUNCTIONS 
ASM (X) - IN LINE ASSEMBLER DIS(X) DISASSEMBLE FROM MEMORY 
LD/SAV (X) - LOAD/SAVE 0=SETUP,1 -REGS,2-EVENTS,3=MAP,4=SWITCHES,5=MACROS 
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Second Page of Help Menu 



CNT 


■ COUNT EVENT 


TGR 


■ TTL TRIGGER STROBE 


RCT 


■ RESET COUNTER 


FSI 


■ FORCE SPECIAL INTERRUPT 


TOC 


■ TOGGLE COUNT 


GROUP X 


■ SWITCH TO GROUP X 



EVENT MONITOR SYSTEM 

DES - DISPLAY ALL EVENT SPECIFICATIONS 

CES - CLEAR ALL EVENT SPECIFICATIONS 

DES X - DISPLAY ALL EVENT SPECIFICATIONS IFOR GROUP X 

CES X • CLEAR ALL EVENT SPECIFICATIONS FOR GROUP X 

EVENT ACTIONS: 
BRK - BREAK 
TRC - TRACE EVENT 
TOT - TOGGLE TRACE 

EVENT DETECTORS - GROUPS 1,2,3,4: 

AC1,AC2 OR AC1.X,AC2.X - 24 BIT DISCREET ADDRESS OR INTERNAL EXTERNAL RANGE 

DC1,DC2 OR DC1.X.DC2.X - 16 BIT DATA, MAY INCLUDE DON'T CARE BITS 

S1.S2 OR S1.X,S2.X • STATUS AND CONTROL - BYT/WRD + RD/UR + TAR/OVL 

- + MEM/IO/IAK/RIO/HSD/IF/RM/WM + QF/NMI/LOK/PEA 

- + ALT/COD/DAT/STA 

LSA - 16 LOGIC STATE LINES, MAY INCLUDE DON'T CARE BITS 
CTL - COUNT LIMIT, ANY NUMBER 1 TO 65,535 

STEP 1 - ASSIGN EVENT DETECTORS STEP 2 ■ CREATE EVENT SPECIFICATIONS 

AC1 = $1234;S1 = BYT + RM WHEN AC1 AND S1 THEN GROUP 2 

AC1.2 = $4576+14*6;DC2.2 = $5600 DC $FF 2 WHEN AC1 AND NOT DC2 THEN CNT 

CTL. 2 - 24;AC2.2 = $F000 LEN $400 WHEN CTL. 2 OR AC2.2 THEN BRK 
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COPYRIGHT 1986 

APPLIED MICROSYSTEMS CORPORATION 

SATELLITE EMULATOR 80286 V1.0 

USER = 0, SW = 

#64K AVAILABLE OVERLAY 
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Prompts 

Different prompts are displayed depending on the current operating mode 
of the ES1800. 



> 



R> 



$12345678 $00 > 

$12345678 $00 R> 

$12345678 $0000 > 
$12345678 $0000 R> 



The standard, or pause mode, prompt from 
ESL consists of a space character followed 
by a right arrow. 

During emulation, the run mode prompt is 
displayed. Most ESL commands are still 
valid. 



In memory mode, the prompt includes the 
memory address and the data contained 
there. Depending on whether byte mode or 
word mode (BYM, WDM) has been chosen, 
the data will be a byte or a word. The run 
prompt may also be present during memory 
mode. 

**** 80286 LINE ASSEMBLER VX.XLA **** 

CSEG = 0000 

0100 > The line assembler displays a 16-bit address 

prompt. This prompt contains an [r] if you 

are assembling during emulation. 

IO:$1200 > 

IO:$1200 $00 > 

IO:$1200 $0000 > 

IO:$1200 R> 

IO:$1200 $00 R> 

IO:$1200 $0000 R> In I/O mode, the prompt includes the I/O 

address. The data is included when a 



return | is entered as the only character on 
the line. The data field is affected by byte 
and word mode. When emulating, the run 
prompt will also be present. 
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Special Modes 

There are a few special modes you can enter, some of which must be exited 
before using regular ESL commands. These modes can be identified by the 
prompt displayed, or lack thereof. 



Line Assembler 



Memory Disassembler 



Memory Mode 
I/O Mode 
Transparent Mode 



The line assembler has a single 16-bit 
address prompt. Exit by entering an [x] or 
the END directive. 

If initiated without a range argument, the 
memory disassembler (DIS) displays a full 
page of data, leaving the cursor at the lower 
right corner of the screen. A | return 



displays the next p age of disassembled 
memory. A |space| causes only the next 
instruction to be disassembled. Any other 
character terminates memory disassembly. 

Memory mode has an address and data 
prompt. Exit by entering an [xj. 

I/O mode has an address prompt. Exit by 
entering an[x|. 

No characters are generated by the ESI 800. 
Exit by entering the two- character escape 
sequence (default is [esc] [esc! ), or system 
reset (default |ctrl| [z] ). 
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Display/Interpretation Modes 



Byte Mode/ 
Word Mode 



The BYM and WDM commands select byte 
or word mode operation. The mode 
selected determines whether 8 or 16 bit data 
is used or displayed. If byte mode is set, 
most data commands use byte values, and 
the indirection operator reads a byte from 
the address given. The same is true of word 
mode. 



Physical Mode/ 
Virtual Mode 



Two commands are used to globally 
designate the mode (PHY for physical 
mode, VIR for virtual mode) in which 
addresses are entered and displayed. (See 
Virtual Operations, page 6-2, for more 
information.) 



Display Mode 



The DMD command displays the data mode, 
emulator mode and processor (CPU) mode. 
See the examples below and on the 
following pages for different combinations. 
The state transition diagram (page 6-7) and 
mode translation table (page 6-5) provide 
information on the possible states. 



>DMD 






DATA MODE 




BYTE 


EMULATOR 


WDE: 


VIRTUAL 


PROCESSOR 


MODE: 


REAL 
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>WDM 




>DMD 




DATA MODE: 


WORD 


EMULATOR MODE: 


VIRTUAL 


PROCESSOR MODE: 


REAL 



>PHY 




>DMD 




DATA MODE: 


WORD 


EMULATOR MODE: 


PHYSICAL 


PROCESSOR MODE: 


REAL 



>PHY 




>DMD 




DATA MODE: 


BYTE 


EMULATOR MODE: 


PHYSICAL 


PROCESSOR MODE: 


REAL 



>MSW=1 




>DMD 




DATA MODE: 


BYTE 


EMULATOR MODE: 


PHYSICAL 


PROCESSOR MODE: 


PROTECTED 



>VIR 




>DMD 




DATA MODE: 


BYTE 


EMULATOR MODE: 


VIRTUAL 


PROCESSOR MODE: 


PROTECTED 
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>RUN 




R> 




R>DMD 




DATA MODE: 


BYTE 


EMULATOR MODE: 


VIRTUAL 


PROCESSOR MODE: 


MOT AVAILABLE DURING 




EMULATION 



R>STP 






CSsIP = 


$F000: 


FPFO 


GROUP 1 






>DMD 






DATA MODE 


: 


BYTE 


EMULATOR 


MODE: 


VIRTUAL 


PROCESSOR 


MODE: 


PROTECTED 
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Special Characters 



DELETE 
BACKSPACE 



CTRLX 
CTRLR 
CTRLZ 



ESC ESC 



CTRLS 



CTRLQ 



Either character deletes a character just 
entered on a command line. 

Deletes an entire command line. 

Redisplays the current command line. 

The default system reset character. Resets 
the Emulator, stops emulation and/or clears 
an error condition. It does not clear or 
update Emulator registers. Used to 
terminated certain diagnostic functions. 
CTRL Z terminates an indefinitely 
repeating command. You can change the 
reset character (see page 5-3). 

The default transparent mode escape 
sequence, which terminates transparent 
mode. You can change the transparent 
mode escape sequence (see page 5-3). 

The default XOFF character. When issued 
from the keyboard, the screen display stops 
scrolling, allowing you to see the 
information. You can change the XOFF 
character (see page 5-3). 

The default XON character. Restarts the 
screen display scrolling after an XOFF is 
issued. You can change the XON character 
(see page 5-3). 
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Errors 

The ESI 800 software generates two basic types of error messages. ES 
Language Syntax and operational errors in a command line are indicated 
by a beep (BEL code). The next line displayed contains a single [?] 
underneath, and usually just after, the place in your command line that 
caused the error. At the point the error is detected, the remainder of the 
command line is discarded. For example, the DRT command is invalid 
during emulation: 



>WHE AC1 THE BRK; RBK; DRT; DR 
<BEL> ? 

R> 



The RBK command was executed, but the DR command was not. 
Whenever you see an error message of this type, you can enter a single [?]. 
The ESI 800 responds with a text message explaining the error. For the 
above example: 



R>? 

ERROR #56 

TRACE DATA IS INVALID DURING EMULATION 

R> 



These error messages are described in this section. The second type of 
error message is caused by target hardware problems. There are various 
conditions that can occur in the target that prevent the pod processor from 
operating. If these error messages are displayed, the problem must be 
remedied before the ESI 800 can be used. The error messages are quite 
explicit: e.g., |no target clock] or Ire set asserTTd I. Target hardware error 
messages are explained in Appendix B. 
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ES Language Error Messages 



1,2,3 EXPRESSION HAS NO MEANINGFUL 

RELATION TO REST OF COMMAND. 
Often caused by entering symbols out of 
context, [dr] and |brk| are both legal, but 
when entered together as Idr brk| would 
cause this error message. 

5 UNDEFINED SYMBOL OR INVALID 

CHARACTER DETECTED. Usually 
caused by improper spelling. 

6 CHECKSUM ERROR IN DOWNLOAD 

DATA. The last record received was in 
error. Make sure that the format selected in 
the system set-up is the same as the format 
of the received data. Refer to download 
command (DNL) for error handling. 

7 BAD STATUS = ...RETURNED FROM 

EMULATOR CARD. Contact Customer 
Service for ES Products. 

8 ARGUMENT IS NOT A SIMPLE 

INTEGER OR INTERNAL RANGE. 
Don't cares are not allowed in this context. 

9 NO MORE OVERLAY MEMORY 

AVAILABLE. You have not cleared the 
map or you are trying to map in more 
memory than is allowed. Contact Applied 
Microsystems for optional overlay memory 
expansion. 

10 MULTIPLE-DEFINED EVENT GROUP. 

Only one group may be referenced in any 
event clause. Error is caused by trying to 
mix event register groups in an event clause 
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(e.g., |2 when AC1.3 then brk| would cause this 
error). 

11 ILLEGAL ARGUMENT TYPE FOR 

EVENT SPECIFICATION. Only the 8 
event comparators may be used in the event 
portion of a WHEN/THEN statement. 

12,13 ARGUMENTS MUST BE A SIMPLE 

INTEGER. Don't care masks and ranges 
not allowed. 

14,15,16 OPERATION INVALID FOR THESE 

ARGUMENT TYPES. Usually caused by 
attempting arithmetic operations on 
incompatible variables (e.g., 
1(4 dc 9) + (Ira 500 "to 700))| . (Same as error 
23.) 

17 SHIFT ARGUMENT CANNOT BE 

NEGATIVE. To shift a value in the reverse 
direction, use the opposite shift operator, 
[>>| or [<<], not a negative shift value. 

18 TOO MANY ARGUMENTS IN LIST ... (9 

MAX). When entering data in memory or 
I/O mode, a list of only 9 values can be 
entered on a single command line. 

19 INVALID GROUP NUMBER . . . (NOT IN 

1-4). There are only four event groups 
(1-4). 

20,21,22,23 OPERATION INVALID FOR THESE 

ARGUMENT TYPES. Often caused by 
attempting arithmetic operations on 
incompatible variables. 
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24 BASE ARGUMENT MUST BE A SIMPLE 

INTEGER. Argument should be #0 to #16. 

26 RANGE TYPE ARGUMENT NOT 

ALLOWED AS DATA. Data can only be 
expressed as masked values or integers. 

27 ADDRESS ARGUMENT MUST BE A 

SIMPLE INTEGER. Cannot use ranges or 
masked values. 

29 ILLEGAL DESTINATION - SOURCE 

TYPE MIX. Caused by trying to store don't 
care data into a range variable or other 
similar operations. 

30,31 RANGE START AND END 

ARGUMENTS MUST BE SIMPLE 
INTEGERS. Cannot use masked values or 
ranges. 

32 RANGE END MUST BE GREATER 

THAN RANGE START. 110 to 5| is an 
example of an invalid range. 

33 RANGE START AND END 

ARGUMENTS MUST BE SIMPLE 
INTEGERS. Cannot use masked values or 
ranges. 

34 READ AFTER WRITE-VERIFY ERROR. 

Data supposedly written to memory during 
a download operation was read back as a 
different value. The error message contains 
the locations and results of the comparison. 

35 WARNING - DATA WILL BE LOST 

WHEN EMULATION IS BROKEN. 
Caused by assigning values to CPU registers 
during emulation. CPU registers are copied 
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into internal RAM only when emulation is 
broken. The RAM contents are copied into 
the processor only when emulation is 
begun. The Emulator cannot access CPU 
registers during emulation. Thus, once 
emulation has been started the DR 
command shows the contents of the CPU 
registers as they were before emulation was 
begun. Changes can be made to these 
values, but the data will be rewritten when 
emulation is broken. 



36,37,38 



NO ROOM . . . BREAKPOINT CLAUSES 
TOO NUMEROUS OR COMPLEX. Too 
many WHEN/THEN clauses were entered. 



39 



INVALID GROUP NUMBER . . . (NOT IN 
1-4). There are only four groups in the 
Event Monitor System. 



40 



ILLEGAL SELECT VALUE. Variable 
cannot be assigned value specified. Check 
manual. 



41 



42 



43 



44 



INCORRECT NUMBER OF 
ARGUMENTS IN LIST. Check command 
argument list. 

ILLEGAL SETUP SET VALUE. Consult 
SET menu for legal values (page 5-3). 

"WHEN" CLAUSE REDUCED TO NULL 
FUNCTION. Caused by constructs such as 

AC1 AND NOT AC1| . 



INTERNAL ERROR . . . NULL SHIFTER 
FILE. Contact Customer Service for ES 
Products. 
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45 MAP CANNOT BE ACCESSED DURING 

EMULATION. The map hardware is 
constantly used by the emulating processor 
during emulation and cannot be accessed. 

46 ARGUMENT MUST BE AN INTERNAL 

RANGE. External ranges and masked 
values not allowed. 

47 16-BIT RANGE END LESS THAN 

START. Invalid range. 

48 ILLEGAL MODE SELECT VALUE. 

49,50 INVALID GROUP NUMBER . . . (NOT IN 

1-4). Must be 1 through 4. 

51 SAVE/LOAD INVALID ARGUMENT 

VALUE. Valid arguments include 
through 5. 

53 EEPROM WRITE VERIFY ERROR. Data 

in the EEPROM is verified during the SAV 
operation. (The store operation is retried 
many times before this error is generated.) 
EEPROMs have a finite write cycle life. 
The EEPROM in your Emulator is 
warranted for one year. Contact Applied 
Microsystems for service. 

54 ATTEMPT TO SAVE/LOAD DURING 

EMULATION. These commands may only 
be used while in the pause mode. 

55 EEPROM DATA INVALID DUE TO 

INTERRUPTED SAVE. Previous SAV 
command was interrupted by a reset or 
power off. 
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56 TRACE DATA IS INVALID DURING 

EMULATION. Viewing of the trace is 
only allowed during pause mode. 

57 (INVALID GROUP NUMBER (NOT 1-4). 

Must use 1 - 4. 

58 IMPROPER NUMBER OF ARGUMENTS. 

Check command argument list. 

59 ARGUMENT MUST BE AN INTERNAL 

RANGE. External ranges and masked 
values not allowed. 

60 ARGUMENT MUST BE A SIMPLE 

INTEGER. Ranges and don't care masks 
not allowed. 

61 IMPROPER NUMBER OF ARGUMENTS. 

See error 58. 

62 CANNOT STORE THIS VARIABLE 

DURING EMULATION. Must be in pause 
mode. 

63 ILLEGAL ARGUMENT TYPE. 

64 ARGUMENT TOO LARGE. Caused by 

entering DRT argument that includes 
numbers greater than #2045. 

65 ILLEGAL RANGE. 

66 STATUS CONSTANTS CANNOT BE 

ALTERED. System constants (e.g., BYT, 
OVL) cannot be assigned values. 
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67 TOO MANY "WHEN" CLAUSES. You 

have tried to enter more WHEN/THEN 
clauses than the Event Monitor System can 
handle. 

68 INVALID DATA FORMAT FOR 

SYMBOLS. Must use Extended Tektronix 
Hex. 

70 CANNOT INITIALIZE VECTORS 

DURING EMULATION. [ldvI, IrnvI, and 



rbvI can only be entered in pause mode. 



71 UNKNOWN EMULATOR ERROR. Call 

Applied Microsystems. 

72 INCOMPATIBLE EEPROM DATA. 

Previous data saved to EEPROM was not 
from an 80286 Emulator system. 

74 COMMAND INVALID DURING 

EMULATION. Must be in pause mode. 

75 INVALID RECORD TYPE. Download 

routine received invalid record type code. 

76 NO SYMBOLIC DEBUG. The symbolic 

debug option is not installed in your system. 
Cannot assign symbol and section values. 

78,79,80 TOO MANY SYMBOLS. Symbols 

exceeded available RAM. Purge symbols 
before downloading again. 

81 SYMBOL OR SECTION PREVIOUSLY 

DEFINED. You must delete a section 
before assigning it a new value. 
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82 SYMBOL NAME IN USE. Symbol name 

cannot be used more than once. 

83 TYPE CONFLICT WITH DEFINED 

SYMBOL. Please refer to Extended Tek 
specification. 

87 SECTION TABLE FULL. Too many 

symbolic section names have been defined. 

88 INVALID ARGUMENT SIZE. Operand 

doesn't fit into destination register. 

89 INVALID ADDRESSING MODE. 

90 ARGUMENT OUT OF RANGE. Usually 

caused by reference to a "FAR" location 
without declaring "FAR." 

91 INVALID TRAP VECTOR NUMBER. 

92 INVALID OP CODE FOR 80286. 

93 INVALID CONTROL REGISTER. 

94 ARGUMENT NOT SYMBOLIC. Requires 

a symbolic argument. 

97 ARGUMENTS MUST BE A VIRTUAL 

ADDRESS.. 

98 ARGUMENTS MUST CONTAIN 

IDENTICAL SELECTORS. 

99 ARGUMENTS NEED 1 6 BIT LAYOUT. 

100 VIRTUAL ADDRESS OFFSET 

OVERFLOW. 
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101 PROTECTION VIOLATION. 

102 VIRTUAL ADDRESS ARGUMENT 

ILLEGAL. 

103 LENGTH OF VIRTUAL ADDRESS 

RANGE MAY NOT EXCEED 64K. 

104 NULL SELECTOR ILLEGAL. 

105 COMMAND INVALID IN REAL MODE. 

106 COMMAND INVALID IN PHYSICAL 

MODE. 

107 NOT A VALID REGISTER. 

108 CANNOT BE MODIFIED DURING 

EMULATION. 

255 UNKNOWN ERROR. 
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SYSTEM COMMANDS 



Setup Commands 

The SET and ON/OFF commands allow you to configure the ESI 800 
according to hardware and debugging needs. There are two menus 
containing variables that are software selectable for quick and easy 
changes. 

The SET menu contains all of the external communication variables such 
as baud rates, parity, and upload/download data format. Some set 
parameters require a reset before becoming effective. You can also set the 
serial communication parameters and save them to EEPROM without 
affecting the parameters currently in use. 

The ON/OFF menu contains switches that control emulation and the serial 
port copy switch. For example, you can run the Emulator without a target 
system by using the Emulator-supplied clock signal, an Emulator- 
generated ready signal and overlay memory. The copy switch copies data 
to both serial ports for obtaining hard copy of your emulation session. 

The SET menu and the ON/OFF menu can be saved to EEPROM after you 
have set them. These values may then be automatically loaded into the 
Emulator on power-up by setting the thumbwheel switch to the 
appropriate value, or manually by typing a load command (LD) to the 
Emulator after power-up. 
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The EEPROM is divided into two groups of six sections. Each section 
within a group may be loaded and saved individually. The two groups 
designate two users, referred to as user or user 1 in the SET menu. This 
allows two users to save complete information about their emulation 
session, and reload it later. The six sections of information are: 



Group # Description 



SET menu 

1 Registers 

2 Event Monitor WHEN/THEN clauses 

3 Overlay map 

4 ON/OFF menu 

5 Macros 
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Command 



Result 



SET 



Displays the SET menu. The 
parameters in this menu specify 
the external communication 
details. 



>SET 






ES SETUP: 


SEE 


MANUAL FOR DETAILS... 


SET #X,#Y 


- SET ITEM X TO VALUE CORRESPONDING TO Y 


LD 0;SAV 


LOAD/SAVE SETUP FOR CURRENTLY SELECTED USER 


SYSTEM: 


#1 USER = 0; [0,1] 




#2 RESET CHAR = $1A 




#3 XON, XOFF = $11, $13 


TERMINAL: 


#10 


BAUD RATE = #14; [2=110,5=300,10=2400,14=9600] 




#11 


STOP BITS = 1 [1,2] 




#12 


PARITY = 0; [0=NONE,1=EVEN,2=ODD] 




#13 


CRT LENGTH = #24 




#14 


TRANSPARENT MODE ESCAPE SEQUENCE = $1B,$1B 


COMPUTER: 


#20 


BAUD RATE = #14; [7=1200,12=4800,15=19200] 




#21 


STOP BITS = 1 




#22 


PARITY = 




#23 


TRANSPARENT MODE ESCAPE SEQUENCE = $1B,$1B 




#24 


COMMAND TERMINATOR SEQUENCE = $0D,$00,$00 




#25 


UPLOAD RECORD LENGTH = #32; [1 to 127] 




#26 


DATA FORMAT = 0; [0=INT,1=MOS,2=MOT,3=SIG,4=TEK,5=XTEK] 




#27 


ACKNOWLEDGE CHAR = $06 
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SET <parameter>, <exp> 



The value of the specified 
parameter is changed to <exp>. 
If you assign an illegal value to a 
variable, an error message is 
displayed, and the value is not 
changed. 



Comments 



The table below shows the valid values for each SET variable. All 
arguments preceeded with a [f] indicate that the value entered must be a 7- 
bit ASCII character. 

The [#] preceding the SET command arguments below is typed in and 
designates the value entered as decimal. The [#] is optional for decimal 
numbers 0-9. 



Parameters 



Description 



Reset Required 



No 
No 



SET#1,#0 

SET#1,#1 



UserO 
User 1 



Two users may save and load values to the EEPROM. 
This parameter indicates which user is active when 
executing the SAV and LD commands. 



SET #2,$n Reset character 



No 



The reset character resets the Emulator and the pod 
CPU. The system default is CTRL Z ($1A). 



SET#3,$n,$m XON/XOFF characters 



No 



XON and XOFF control the screen scrolling. An 
XOFF stops a scrolling display. XON resumes scrolling 
the display. The system defaults are CTRL Q, CTRL S 
($13, $11). 
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Parameters Description Reset Required 



SET#10,#1 75 baud Yes 

#2 110 baud 

#3 134.5 baud 

#4 150 baud 

#5 300 baud 

#6 600 baud 

#7 1200 baud 

#8 1800 baud 

#9 2000 baud 

#10 2400 baud 

#11 3600 baud 

#12 4800 baud 

#13 7200 baud 

#14 9600 baud (default) 

#15 19200 baud 

The terminal port baud rate 

SET # 1 1 ,# 1 1 stop bit (default) Yes 

#2 2 stop bits 

The number of stop bits for the terminal port 

SET#12,#0 No Parity (default) Yes 

#1 Even Parity 
#2 Odd Parity 

The parity for the terminal port 

SET #13,#n CRT length (default: 24 lines) No 

The maximum number of lines displayed for 
commands that use paging 
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Parameters Description Reset Required 



SET # 1 4 ,$n ,$m Transparent mode 

escape sequence No 

When entered from either port, transparent mode is 
terminated. The default sequence is ESC, ESC 
($1B,$1B). 

SET#20,#1 75 baud Yes 

#2 110 baud 

#3 134.5 baud 

#4 150 baud 

#5 300 baud 

#6 600 baud 

#7 1200 baud 

#8 1800 baud 

#9 2000 baud 

#10 2400 baud 

#11 3600 baud 

#12 4800 baud 

#13 7200 baud 

#14 9600 baud (default) 

#15 19200 baud 

The computer port baud rate 

SET #21, #1 1 stop bit (default) Yes 

#2 2 stop bits 

The number of stop bits for the computer port 

SET #22,#0 No parity (default) Yes 

#1 Even parity 
#2 Odd parity 



Parity for the computer port 
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Parameters Description Reset Required 



SET #23,$n,$m Transparent mode 

escape sequence No 

When entered from the computer port, transparent 
mode is exited. The default sequence is ESC, ESC 
($1B,$1B). 

SET#24,$n,$m,$o 

Command terminator sequence No 



The default sequence is [return], null, null (SOD, $00, 
$00). 

SET #25,#n Upload record length No 

The maximum length for an upload record. (The 
default length is 32 bytes of data.) 



No 



SET#26,#0 


Intel (default) 


#1 


MOS 


#2 


Motorola 


#3 


Signetics 


#4 


Tektronix 


#5 


Extended Tek 



Upload/download serial data format 

SET #27,$n Acknowledge character No 

The acknowlege character is sent when a valid record is 
received when downloading in computer control. The 
default is $06. 
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Comments 



Some SET parameters require the system to be reset, and prompt for a reset 
character. If you change a parameter that requires a reset, but do not enter 
one, subsequent displays of the SET menu show the new value you have 
assigned the variable, even though it is not currently in effect. 

If you change the SET parameters and wish to use the new values at a later 
date, you can save them in EEPROM by entering a SAV or SAV 
command. 

Saved parameters can be loaded automatically at power- up or manually 
after the system is up and running. To load automatically, set the 
thumbwheel switch (see page 3-5) before turning on the Emulator. To 
load manually, enter LD (to load all variables and settings) or enter the LD 
command (to load just the SET parameters). 

See Serial Communication (page 5-38) for information on communicating 
with a host computer. 
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Command Result 

ON 

OFF Displays the ON/OFF menu. 







ES SWITCH SETTING MENU 


NAME 


STATE 


DESCRIPTION 


BKX 


OFF 


BREAK ON INSTRUCTION EXECUTION (NOT PREFETCH) 


BTE 


OFF 


BUS(RDY) TIMEOUT ENABLE 


CEE 


OFF 


COPROCESSOR ERROR ENABLE 


CK 


ON 


SELECT INTERNAL CLOCK 


CPY 


ON 


COPY DATA TO TERMINAL & COMPUTER PORTS 


DBE 


OFF 


DESCRIPTOR TABLE BREAK ENABLE 


ENI 


ON 


ENABLE INTERRUPTS 


FSX 


ON 


FSI ON INSTRUCTION EXECUTION (NOT PREFETCH) 


IEE 


OFF 


INTERRUPT ERROR ENABLE 


IHE 


OFF 


IGNORE HALT ERRORS 


IM 


OFF 


INTROSPECTIVE MODE 


PEN 


ON 


PAUSE MODE PROTECTION ENABLE 


PPT 


OFF 


TRACE PEEK AND POKE CYCLES 


RDY 


ON 


SELECT INTERNAL READY WHEN ACCESSING OVERLAY 


RMS 


OFF 


REAL MODE SELECT 


SLO 


OFF 


SLOW INTERRUPT ENABLE 


ST I 
> 


OFF 


ENABLE STEP THROUGH INTERRUPTS 



Comments 
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Comments 



Some switches cannot be set during run mode. 

The arguments to the ON and OFF commands are the names of the 
switches themselves. These are: 









Changeable 


Switch 


Description 


Default 


During Emulation 


BKX 


Break on instruction execution 


OFF 


yes 


BTE 


Bus (RDY) timeout enable 


OFF 


yes 


CEE 


Coprocessor error enable 


OFF 


yes 


CK 


Internal/external clock 


OFF 


no 


CPY 


Copy data to both serial ports 


OFF 


yes 


DBE 


Descriptor table break enable 


OFF 


no 


ENI 


Enable interrupts 


ON 


yes 


FSX 


Force special interrupt 








on instruction execution 


ON 


yes 


IEE 


Interrupt error enable 


OFF 


yes 


I HE 


Ignore halt errors 


OFF 


yes 


IM 


Introspective mode 


OFF 


no 


PEN 


Pause mode protection enable 


CN 


no 


PPT 


Trace peek and poke cycles 


OFF 


yes 


RDY 


Interna I /externa I ready signal 


OFF 


no 


RMS 


Real mode select 


OFF 


no 


SLO 


Slow interrupt enable 


OFF 


yes 


ST I 


Step through interrupts 


OFF 


yes 



You may turn on or off multiple switches by listing them with a between 
their names. 



All switches can be turned off with the command, |>off -1 



You can save all of the current switch settings in EEPROM for later use by 
executing a SAV (to save all variables and settings) or SAV 4 (to save just 
switch settings) command (see page 5-36). 
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SWITCH SETTING (cont.) 



The saved switches can be loaded automatically at power-up or manually 
after the system is up and running. To load automatically, set the 
thumbwheel switch (see page 3-5) before turning on the Emulator. To 
load manually, enter a LD (to load all variables and settings) or LD 4 (to 
load just the switch settings) command (see page 5-34). 



Examples 



If you want a hard copy of an emulation session, attach a printer to the 
computer port on the back chassis of the Emulator. Turn on the copy 
switch so that all data is copied to both serial ports. 



>0N CPY 

> 



Assume that you are debugging a program on a new piece of hardware. 
The program has already been debugged using the Emulator's overlay 
memory and appears to be functioning properly. When you try to run the 
program in the hardware it does not work correctly. In this case you may 
want to switch back and forth between running from overlay memory and 
the target. When running out of overlay you want to use an internal clock 
and ready signal. You do this with these two commands: 



>0N RDY+CK 
>OFF RDY+CK 



Here are two alternative methods for doing the same thing using fewer 
keystrokes. 

The first is to use a general purpose register for the command parameter. 
Assign the register the switch names. Then use the register as the 
parameter for the commands. 
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SWITCH SETTING (cont.) 



>GRO 


= RDY+CK 


>0N 1 


3R0 


>OFF 


GRO 



The next way is to use two macros for the commands. Assign macros 1 and 
2 to the ON and OFF commands. Execute these macros by typing a Q and 
□ as the first character on each line (see page 5-107). 



>_1=ON RDY+CK 
>_2=OFF RDY+CK 

>. 
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BREAK ON INSTRUCTION EXECUTION 



Command 



Result 



ONBKX 



The Event Monitor System 
breaks on the execution of the 
instruction rather than the 
instruction pre-fetch. 



OFF BKX 



The Event Monitor System 
breaks whenever an address is 
seen on the bus. (Break on 
prefetch of instruction.) 

Default: OFF 



Comments 



The 80286 prefetches instructions. Because of this, an address can be 
detected on the address bus before the instruction is actually executed. If 
you set a breakpoint on an address that immediately follows a branch, the 
Emulator may break, even before the instruction is executed (it was 
prefetched). Set this switch to force the break to occur only on address 
execution. 

When "breaking on instruction execution" the address entered into the 
address comparator register must be the address of the beginning of the 
instruction. The addresses are prequalified by the prefetch BRK 
hardware. Thus the address that causes the "break on instruction 
execution" must be seen first as a prefetched address. 
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BUS TIMEOUT ENABLE 



Command 



Result 



ONBTE 



ON BTE allows hardware to 
return a RDY to the CPU if 
there has been no activity with 
ALE for longer than 1.3 
seconds. When the CPU waits 
longer than .5 seconds for a 
RDY signal, the message 
PROCESSOR WAITING is 
displayed. When bus timeout 
occurs, a RDY is asserted to the 
CPU. A BRK is also asserted to 
the CPU, causing emulation to 
break. This saves the contents 
of the CPU registers and trace at 
the point where the CPU 
stopped executing., The error 
message BUS TIMEOUT 
ERROR is displayed after 
emulation breaks. During 
peek/poke cycles the Emulator 
displays the message 
PROCESSOR WAITING if the 
CPU has been waiting for a 
RDY more than .5 seconds. 
After 1.3 seconds, the Emulator 
returns a RDY to the CPU and 
displays the data that was read. 
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BUS TIMEOUT ENABLE (cont.) 

OFF BTE The processor waits for a ready 

signal. After .5 seconds, an 
error message displays. 

Default: OFF 



Comments 



Bus timeout is disabled when a HOLDA or HALT is asserted by the CPU 
regardless of the state of the BTE switch. 
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COPROCESSOR ERROR ENABLE 



Command Result 



ONCEE When PEREQ, BUSY, or 

ERROR are asserted for longer 
than .5 seconds, PEREQ 
ASSERTED, INTR 

ASSERTED, or ERROR 
SIGNAL ASSERTED, 
respectively, are displayed. 
This may or may not indicate an 
error, depending on the target 
system design. 

OFFCEE When PEREQ, BUSY, or 

ERROR are asserted for longer 
than .5 seconds, PEREQ 
ASSERTED, INTR 

ASSERTED, or ERROR 
SIGNAL ASSERTED are not 
displayed. 

Default: OFF 
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INTERNAL/EXTERNAL CLOCK 



Command 



Result 



ONCK 



The CPU uses an internally 
generated clock. This is a 
nonadjustable clock set at 12.5 
MHz (CPU speed). 



OFFCK 



The CPU uses the target system 
clock. 



Default: OFF 



Comments 



This command is valid only in pause mode. 

Use an internal clock when debugging code before target hardware is 
available. Download the program to overlay memory. Turn on the 
internally generated ready signal and clock (ON RDY and ON CK) and 
begin debugging. 

See also the Download command, pages 5-46, the overlay memory section, 
page 5-62, and the RDY switch, page 5-29. 
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COPY DATA TO BOTH PORTS 



Command 



Result 



ONCPY 



Sends all data to both the 
terminal and computer ports. 
Data sent to the controlling port 
is echoed to the other port 
(noncontrolling port). 



OFF CPY 



Only sends data from the 
Emulator to the controlling 
port. 



Comments 



Default: OFF 



This provides a way to make a hard copy of emulation data. It is also 
useful for monitoring computer control commands. 

See Serial Communications, page x, for more information on the terminal 
and computer ports. 

The controlling port is determined by the thumbwheel switch on power-up 
and by the SET menu after power-up. 
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DESCRIPTOR TABLE BREAK 



Command 



Result 



ONDBE 



ON DBE causes the Emulator to 
break emulation when any 
descriptors currently being used 
by the Event Monitor System 
are modified. 



OFF DBE 



Ignores writes to the descriptor 
table. 

Default: OFF 



Comments 



The descriptor breakpoint hardware is separate from the Event Monitor 
System and thus does not take away any power from the Event Monitor 
System. 

Examples 



AC1 = 8:0 
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DESCRIPTOR TABLE BREAK (cont.) 



This address comparator is set to an address that uses descriptor table entry 
1 in the global descriptor table. If DBE is ON and a write to descriptor 
table entry 1 in the global descriptor table is detected, the Emulator breaks 
and the message DESCRIPTOR TABLE MODIFIED is displayed. 
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ENABLE INTERRUPTS 



Command 



Result 



ONENI 



Enables interrupts upon 
entering emulation. May be 
used in conjunction with the 
SLO switch. 



OFF ENI 



Disables interrupts. 
Default: ON 



Comments 



This switch has no effect on the STI (step through interrupts) switch. 
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FSI ON INSTRUCTION EXECUTION 



Command 



Result 



ONFSX 



An Event Monitor System 
forced special interrupt (FSI) 
occurs when an instruction is 
executed. Refer to page 7-25 
for the FSI command. 



OFF FSX 



Forced special interrupt (FSI) 
occurs when an address is seen 
on the bus (on prefetch of 
instruction). 



Default: ON 



Comments 



The 80286 prefetches instructions. Because of this, an address can be 
detected on the address bus before the instruction is actually executed. If 
you set an FSI on an address that immediately follows a branch, the 
Emulator may execute the FSI before the instruction is executed (it was 
prefetched). Set this switch to force an FSI to occur only on address 
execution. 

When entering addresses that will cause an FSI on instruction execution, 
the addresses must indicate the beginning of the instruction. All addresses 
to be qualified on execution are also prequalified by the Event Monitor 
System as prefetch addresses. 
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INTERRUPT ERROR ENABLE 



Command Result 



ONIEE When INTR is asserted for 

longer than .5 seconds, the error 
message INTR ASSERTED .5 
SECS is displayed. This may or 
may not indicate an error, 
depending on the target system 
design. 

OFFIEE When INTR is asserted for 

longer than .5 seconds, the error 
message INTR ASSERTED is 
not displayed. 

Default: OFF 
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IGNORE HALT ERRORS 



Command 



Result 



ONIHE 



ON IHE inhibits the HALT 
ASSERTED error message from 
appearing on the screen. The 
user may assert this switch when 
the halt mode is entered 
multiple times and causes the 
message to scroll across the 
screen. 



OFF IHE 



Halt mode is monitored, and if 
active for more than .5 seconds, 
an error message is displayed. 

Default: OFF 
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INTROSPECTIVE MODE 



Command 



Result 



ONIM 



Uses the Emulator's internal 
memory space as the target 
system. Peeks and pokes are 
directed toward the Emulator's 
internal memory space. You 
cannot run or step in this 
internal environment. 



OFFIM 



Hardware connected to the 
Emulator is regarded as the 
target system. All peeks and 
pokes are directed to the target 
environment. 



Comments 



Default: OFF 



This command is valid only in pause mode. 
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PAUSE MODE PROTECTION 



Command Result 



ON PEN Violations of the Intel pro- 

tection mechanisms cause 
"PROTECTION VIOLA- 
TION:" type errors or "ERROR 
#104 NULL SELECTOR 
ILLEGAL" to display. 

OFF PEN Violations of the protection 

mechanisms are ignored. If you 
set a selector value (CS, DS, SS, 
ES), the access rights and limits 
are overridden. You will see the 
error message "OFF PEN: 
OVERRIDING ACCESS 
RIGHTS AND LIMITS." 

Default: ON 
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PEEK/POKE TRACE 



Command 



Result 



ON PPT 



Traces peek and poke cycles as 
specified by the Event Monitor 
System. If the Event Monitor 
System is cleared and PPT is 
ON, all peek and poke cycles are 
traced. 



OFF PPT 



Comments 



The Emulator does not trace 
peek or poke cycles regardless 
of what is specified by the 
Event Monitor System. The 
trace buffer only records during 
execution of the RUN command 
(as denoted by the [r>] prompt) 
or a STP. 

Default: OFF 



This command is valid only in pause mode. 

If peek or poke cycles are traced, they may corrupt trace disassembly. 
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PEEK/POKE TRACE (cont.) 



Examples 



ON PPT 

AC1 = 5550 

CES; WHEN AC1 THEN TRC 

ITR 

SF 1, 5000 TO 5FFF 



All peeks, pokes, and memory cycles at the specified memory location are 
traced by trace memory. To display the transactions that occurred during 
the overlay memory diagnostic, use the DRT command. In this particular 
case, all accesses to 5550 are traced. Peek or poke cycles occur during 
memory display commands (e.g., DB, MM) and memory modify commands 
(e.g., MM, DNL, SF, BMO). 

NOTE: The Event Monitor System must be initialized via the ITR 
command (see page 7-17) after setting up the WHEN/THEN statements 
and Event Monitor registers and before initiating the desired peek/poke 
cycle. 
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INTERNAL/EXTERNAL READY SIGNAL 



Command 



Result 



ONRDY 



Selects an internally generated 
ready signal to complete 
memory accesses. This allows 
use of overlay memory when no 
target system is being used. 



OFF RDY 



Selects the target system's ready 
signal to complete memory 
accesses. 



Comments 



Default: OFF (See note on the 
next page.) 



A ready signal denotes the end of a memory cycle. See the Intel iAPX286 
Hardware Reference Manual and the Intel iAPX286 Programmer's 
Reference Manual for details. 

If overlay memory is mapped in an area where target memory is 
nonexistent, the target decode logic may not provide a ready signal. An 
ON RDY provides this signal, allowing overlay memory to be used in those 
areas. 

When the ready switch is on and the target system is also providing a ready 
signal, the first ready signal back to the Emulator will be the one used. 

If internal ready is selected and there is a target, there is no 
synchronization between the ready signal and the target hardware. This 
can cause problems if a ready is returned by the Emulator before the target 
hardware is ready. 
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INTERNAL/EXTERNAL READY SIGNAL (cont.) 



Do not use ON RDY when overlaying dynamic RAM. 

NOTE: Default is ON if there is no target clock on power-up and if 
internal clock has been selected. 
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REAL MODE SELECT 



Command 



Result 



ON RMS 



The Emulator register ADF is 
forced on the address line 20-23 
when going into run mode or 
peeking and poking. The 
register ADF may be set to 
$0-$F. 



OFF RMS 



Address lines A20-A23 are 
defined as high at power-up 
and low after the first CS (code 
segment register) change until 
virtual protected mode is 
entered. 

Default: OFF 



Comments 



Before entering virtual mode, RMS must be OFF or the incorrect address is 
seen on A20-A23. 

The RMS switch cannot be modified during emulation. 
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SLOW INTERRUPT ENABLE 



Command Result 



ONSLO Interrupts are enabled after 14 

instruction fetches. 

OFFSLO Interrupts are enabled 

immediately upon entering run 
mode. 

Default: OFF 
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STEP THROUGH INTERRUPTS 



Command 



Result 



ONSTI 



The Emulator recognizes an 
interrupt and steps through the 
interrupt service routine. 



OFF STI 



The Emulator ignores interrupts 
while stepping through a 
program. 



Comments 



Default: OFF 



Stepping through code is a common way to locate software bugs. This 
switch allows you to ignore interrupts while debugging higher level 
routines, or to step through and debug the interrupt routine itself. 

See also the Step command (STP) on page 6-23. 

The ENI and SLO switches do not affect the STI switch. 
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LOAD SYSTEM VARIABLES FROM EEPROM 



Command 



Result 



LD 



Copies all system variables 
stored in EEPROM into 
Emulator memory. 



LD <category> 



Copies the variables from one of 
the six categories in the 
EEPROM to the Emulator 
RAM. 



Comments 



This command is valid only in pause mode. 

Executing a LD command reads system variables from the EEPROM and 
copies them to into internal ESL RAM. The EEPROM retains those 
original variables until replaced by a SAV command. 

There is room in the EEPROM to load the system variables for two 
different users. The user is determined by a parameter in the SET menu. 

You may load the following variable categories from EEPROM: 



- SET menu 

1 - Contents of Emulator registers 

2 - Event Monitor System WHEN/THEN statements 

3 - Overlay map 

4 - Software switch settings 

5 - Macros 
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LOAD SYSTEM VARIABLES FROM EEPROM (cont.) 



Examples 



>LD 3 



The overlay memory map in the EEPROM is copied into internal RAM. 
This causes overlay to be mapped. Use the DM command to verify the new 
map. (See page 5-63.) 
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SAVE SYSTEM VARIABLES IN EEPROM 



Command 



Result 



SAV 



Copies all system variables from 
Emulator memory into 
EEPROM. 



SAV <category> 



Saves one of the six categories 
of variables from Emulator 
RAM to EEPROM. 



Comments 



This command is valid only in pause mode. 

A SAV operation may take up to two minutes. 

DO NOT INTERRUPT THE PROCESS! 

Values saved to EEPROM continue to be valid within the Emulator. 

There is room in EEPROM to save the system variables for two different 
users. The user is determined by a parameter in the SET menu. When you 
execute a SAV, the variables are saved to the user partition currently 
defined in the SET menu. 
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SAVE SYSTEM VARIABLES IN EEPROM (cont.) 



This chart shows the categories of information that can be saved in 
EEPROM and the corresponding page numbers to find more information. 



- SET menu 


page x 


1 - Contents of Emulator registers 


page x 


2 - Event Monitor System 


page x 


WHEN/THEN statements 




3 - Overlay map 


page x 


4 - Software switch settings 


page x 


5 - Macros 


page x 



Variables are loaded from EEPROM back to the Emulator using the LD 
command. 

When you first use the Emulator, you should execute a SAV command with 
no parameter. This initializes EEPROM, so that subsequent LD commands 
will work properly with the 80286 Emulator board and pod. 



Examples 



>SAV 1 



Saves the current values of all the Emulator registers in EEPROM. 
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Serial Communications 

The ESI 800 can communicate through both DB-25 connectors on the 
chassis rear panel using standard RS232C serial protocol. The ports can be 
independently configured for baud rate, data length, and number of stop 
bits. 



USING A HOST COMPUTER 

The most common development configuration is with a terminal connected 
to the terminal port of the ESI 800 and a host development system 
connected to the computer port. The ESI 800 provides a transparent mode 
that essentially connects your terminal to the computer. The ESI 800 also 
has a special download command to load modules from the host system. 

In configurations where the ESI 800 is connected directly to a host 
computer, there are a few details that need to be considered. 

DATA BUFFERING AND BAUD RATE 

When downloading from a computer, the ESI 800 buffers all the data bytes 
until the end of record. If the checksum is correct, the data are then 
loaded into target memory. During this load time, the host computer may 
start sending the next data record. The serial data buffer in the ESI 800 is 
64 bytes deep. When the sixth character is placed in the buffer, an XOFF 
character is sent to the host computer. This means that the host computer 
must transmit no more than 58 characters after the XOFF. Some multi- 
tasking development systems may not be capable of quickly stopping 
character transmission. For these systems, it may be advisable to lower the 
computer port's and host computer's baud rates. 

XON and XOFF characters can be used to control either output port on the 
ESI 800. These characters are user definable. The problem described in 
the above paragraph can happen in the reverse direction. If the ESI 800 is 
uploading data to the host, it may be able to overrun the host's ability to 
receive characters. While lowering baud rates may help, there are probably 
commands available on the host to solve the problem. You should also 
make sure that the host does not echo characters sent to it while uploading 
data. If the characters are echoed, the ESI 800 will quickly send an XOFF 
to the host while continuing to send normal upload characters. The host 
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Section 5: System Commands 



system will then probably send an XOFF to the ESI 800 because the host's 
buffers are full. The result of this situation is that both systems will lock 
up waiting for the other to send an XON. See your system administrator or 
call Applied Microsystems Corporation customer service at 
1-800-426-3925 for help. 

COMMUNICATION WITH THE HOST COMPUTER 

While in transparent mode, the ESI 800 passes characters between the 
computer and terminal ports. There is a user definable two-character 
escape sequence to exit transparent mode. If the first character of the 
escape sequence arrives at either port, the ESI 800 holds it until it receives 
another character from the same port. If the second character matches the 
second character of the escape sequence, transparent mode is terminated. 
If the second character is not part of the escape sequence, then both the 
character being held and this second character are sent to the proper port. 
See page 5-3 for setting the escape character sequence. 

While in transparent mode, the only characters that are meaningful to the 
ESI 800 are XON, XOFF, the first character of the escape sequence, and 
the reset character. The reset character may be sent from the host as part 
of a command sequence to the terminal. This is common during edit 
sessions and depends on the command set of your terminal. You should 
define the reset character to be a character that will not normally be used 
by the host system. 

PORT DEPENDENT COMMANDS 

Most commands are symmetric with respect to the controlling port and 
appear to respond in the same manner if entered from either the computer 
port or the terminal port. The "controlling" port is determined at power- 
up by the setting of the thumbwheel switch on the controller board (see 
page 3-5). After power-up, the commands CCT and TCT switch control 
from one port to the other. TCT entered to the terminal port acts like a 
null command as does a CCT entered at the computer port. 



Entering transparent mode from either port causes both ports to be 
"connected" to each other. If transparent mode is terminated from either 
port, control returns to the port that initiated the transparent mode (TRA) 
command. 
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DOWNLOAD FROM TERMINAL PORT 

When the ESI 800 receives a download command (DNL), it always expects 
data records to arrive at the computer port. If the download command is 
entered from the terminal port, the ESI 8 00 automatically enters 
transparent mode to allow you to send commands to the host system. You 
normally enter a command that causes the host system to copy the 
formatted object file to your terminal (see page 5-3 for setting serial data 
format). The proper procedure is to enter the command to the host system 
but not terminate it (i.e., do not press the [return] key). Instead, enter the 
two-character transparent mode escape sequence. When transparent mode 
terminates, control returns to the download process. The download routine 
then sends the user definable command terminator sequence to the host 
system (see page 5-3 for setting the command terminator sequence). The 
host system responds by sending the data records from the formatted 
object file. Any characters sent by the computer are echoed to the 
terminal port. All valid data records are copied into internal buffers and 
the data written into target memory. When the End of File (EOF) record is 
received, the download process terminates and a normal ESL prompt is 
displayed. 

If an error occurs (checksum or read-after-wrlte) during the download, 
the process terminates with an error and a new prompt is displayed. No 
special characters are sent to the host, however, so it is likely that the next 
time you enter transparent mode, the host will send the remainder of the 
download data records. 

DOWNLOAD FROM COMPUTER PORT 

If the download command is entered from the computer port, the process is 
different. In this case, the ESI 800 does not enter transparent mode. The 
DNL command can be immediately followed by data records. Each data 
record is acknowledged with an ACK (6) character if its checksum is 
correct and correctly written into target memory (verified with read- 
after- write cycles). The EOF record is also acknowledged if valid. If an 
error occurs during a download, the first character sent back to the host 
will be the BEL (7) code. Programs written on the host system can use 
these two characters to handshake the data records in an automatic 
download routine. 
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TRANSPARENT MODE 



Command 



Result 



TRA 



The system enters transparent 
mode. 



ESC ESC 



Port control is returned to the 
previous settings! Note that this 
escape sequence can be changed 
using the SET command (page 
5-3). 



Comments 



Transparent mode can be entered while in terminal (TCT) or computer 
control (CCT) modes. 

In transparent mode the Emulator acts only as an interface between the 
two serial ports. The Emulator can buffer up to 64 characters for each port 
and can operate each port at independent baud rates. 

There must be devices connected both to the terminal port (such as a 
terminal) and the computer port (host system, line printer) for this 
command to have any meaning. 

Transparent mode is used to communicate with a host computer or any 
other peripheral you want to attach to a serial port. 

Refer also to Serial Communications (page 5-38). 
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TRANSPARENT MODE (cont.) 



Examples 



>TRA 



Data entered at either port is transmitted directly to the other port. 
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TERMINAL PORT CONTROL 



Command Result 



TCT The terminal port becomes the 

controlling port. 



Comments 



This command, along with the OCT command, allows control to be 
switched between to two serial ports without powering down the ESI 800 
Emulator. 

Any output generated by a command is directed to the controlling port. 
The copy switch directs output to both serial ports. 

This command is essentially a null command when entered from the 
terminal port. (See page 5-39 for a discussion of port dependent 
commands.) 

Port selection on power-up is controlled by the thumbwheel switch setting. 
(See page 3-5.) 
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COMPUTER PORT CONTROL 



Command Result 



CCT The computer port becomes the 

controlling port. 



Comments 



This command, along with the TCT command, allows control to be 
switched between the two serial ports without powering down the ESI 800 
Emulator. 

Any output generated by a command is directed to the controlling port. 
The copy switch directs output to both serial ports. 

This command is essentially a null command when entered from the 
computer port. 

If there is a host attached to the computer port and you type a CCT from a 
terminal connected to the terminal port, the host systeni takes control of 
the Emulator. The host system must be able to handle incoming data at 
high rates. Both hardware and software handshakes are supported (see 
page 3-12). 

The upload and download operations always send/receive data from the 
computer port regardless of which port is the designated controller. 

If you execute CCT in error with no terminal or host system connected to 
the computer port: 

■ Move the terminal cable to the computer port, enter the 
TCT command and return the cable to the terminal port. 

This process will work in most cases to return control to 
terminal. If not: 
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COMPUTER PORT CONTROL (cont.) 



■ Turn the Emulator off and then on. 

This command can be executed from the computer port (see page 5-39 for 
a discussion of port dependent commands). For port selection on power- 
up refer to page 3-5. 
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DOWNLOAD OPERATIONS 



Command 



Result 



DNL 



DNL readies the Emulator to 
receive data. If in terminal 
control mode, the Emulator 
enters a transparent mode 
automatically, allowing direct 
communication with the host 
system. Other host system 
commands may be executed 
prior to the download operation. 



Comments 



You can choose the destination of the downloaded file: 

■ Target memory 

■ Emulator overlay memory 

If the downloaded data is going to overlay memory, verify that the overlay 
is mapped in the appropriate address range. Make sure that the start 
address of the file is the address to which you expect to download. 

Verify also that the data format of the host system file matches that being 
used by the Emulator. Refer to SET menu set parameter #26 for 
verification of Emulator format. Use transparent mode (TRA) to verify 
host system format and the address in the file. (See page 5-41 .) 
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DOWNLOAD OPERATIONS (cont.) 



You can download files with either the computer port or the terminal port 
in control. That is, the downloading of files can be initiated and controlled 
either by the user or by a host system. There are some differences in 
procedure depending on which port is in control of the downloading 
process. 

DOWNLOADING UNDER TERMINAL PORT CONTROL 

After typing DNL, the system automatically enters transparent mode, 
allowing communication with the host system. When you are ready to 
download the file, enter a command that causes the host system to display a 
file to the terminal, but in place of a I return! , enter the transparent mode 
escape sequence (see page 5-41). 

The Emulator is now ready to read the data records the host system will be 
sending. Data records are displayed as they are received by the Emulator. 
Checksums are verified and if a checksum error occurs, the download is 
aborted with an error message. The data in the erroneous record will not 
have been written to memory. 

Each data byte is verified with a "read after write" cycle. If an error is 
detected, the download is aborted. 

RETURN CONTROL TO EMULATOR 

Once the download command (DNL) is entered, control is returned to the 
Emulator in one of three ways: 

1 . An end of file record is received. If an end of file record 
is not recognized by the Emulator, control will not be 
returned to the Emulator terminal port. This can be 
caused by: 



■ Using a I return 1 instead of the proper 



escape sequence to terminate the 
command line to the host computer 

Selecting the incorrect data format. 
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DOWNLOAD OPERATIONS (cont.) 

2. An Emulator reset is executed (default is CTRL Z). 

3. An error is detected. 

DOWNLOADING UNDER COMPUTER PORT CONTROL 

To download while in computer control with a host computer attached, the 
host computer should send: 



>DNL 



After the host sends the download command, the Emulator waits for data 
at the computer port. The host computer should then send the 
downloadable records followed by an end of file record. After the end of 
file record, the system prompt ( [>) ) is sent to the computer port. 

An acknowledge character (factory default is ASCII ACK $06) will be sent 
to the computer port after storing a data record, when in computer control. 
No acknowledgments are sent when in terminal control. 

There are some differences between computer port control and terminal 
port control during the downloading process. Under computer port 
control: 



All good records are adknowledged with an |ack $6 



All error messages from bad records are received on the 
computer port; therefore the host file that is controlling the 
Emulator will need to be able to interpret error messages. 

i Records are not echoed. 



SYMBOLIC DOWNLOAD 

The download command accepts symbolic definition records as well as 
data records when the symbolic debug option is used and the Emulator 
download format variable is set to 5 (Extended Tekhex). (See SET 
parameter #26, page 5-3.) 
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DOWNLOAD OPERATIONS (cont.) 



Serial data can be verified with memory constants using the VFY 
command. 



Errors 



CHECKSUM ERROR IN THE DATA RECORD 

The download process is aborted because the checksum sent with a record 
file is not the same as the checksum calculated by the Emulator. 

READ AFTER WRITE VERIFY ERROR 

Every byte in a data record is verified after it is stored. This error 
indicates that the data in memory does not match the data that was stored. 



Problem 



What to Check 



Emulator does not return a prompt 
after file has been sent. 



1 . Serial data format - SET 
menu. 

2. No end of file (EOF) 
record. 



You entered a I return 
instead of the 
transparent mode escape 
sequence after entering 
the host copy command 



Read- after- write verify error. 



1. Target 
problem. 



hardware 
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DOWNLOAD OPERATIONS (cont.) 



Problem 



What to Check 



Overlay memory not 
mapped in download 
range. Address is 
indicated by misverify 
message. 



Checksum error. 



1. Improperly formatted 
record sent by host. 

2. Noisy serial data lines. 

3. Host computer is not 
responding to 
XON/XOFF protocol. 



Display of data does not 
commence after entering 
transparent mode escape 
sequence. 



1. Host not responding to 
user defined command 
terminator sequence - 
SET menu (page 5-3). 



If the Emulator does not return a prompt, you will need to reset the system 
(default is CTRL Z) in order to enter any other Emulator commands. 

If the host computer does not respond to the XON/XOFF protocol fast 
enough, you may need to lower the baud rate on the computer port and the 
host computer. 
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VERIFY SERIAL DATA 



Command 



Result 



VFY 



Verifies serial data with data in 
memory. If the data in memory 
does not match the incoming 
serial data, this message is 
displayed: 



ADDRESS = XX NOT YY 



Comments 



Address is the address where the 
data mismatch occurred. XX 
denotes the actual data present 
at that location. YY is the serial 
data just sent. 



This command is similar to the download command but no data is written 
to memory, and the serial data is not displayed on the screen. The serial 
data is compared to the data in target or overlay memory. Mismatches are 
displayed. 

Use this command if you suspect a file you downloaded was corrupted. If 
downloaded data is being corrupted by your program, you can detect it by 
mapping overlay as RO (read only) (see page 5-67). 

This command is also useful for determining differences between object 
files. Follow instructions for downloading a file on page 5-40. 
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UPLOAD SERIAL DATA 



Command Result 



UPL <range> The Emulator formats and sends 

data to the computer port. 



Comments 



Data is transferred from the Emulator to a host system or other peripheral 
interfaced to the Emulator computer port. 

When uploading to a file on a host system, enter transparent mode first and 
open a file to store the uploaded data records. (Review the Serial 
Communications discussion, pages 5-38 - 5-40.) 



Examples 



For UNIX: 



Cat ><filename> 



For VMS: 



TYPE ><filename> 



(Create or EDT are also acceptable.) 
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UPLOAD SERIAL DATA (cont.) 
For CPM: 



PIP A:<filename> = RDR: 



Next, type the transparent mode escape sequence and the upload 
command. 

After all data has been uploaded and the Emulator prompt returns, enter 
transparent mode and close the file by entering the appropriate control 
character. 

Remember to close the file before trying to view it. 

If the host system does not respond to XON/XOFF protocol, it may be 
necessary to lower the communicating port's baud rates so that the host's 
input buffer is not overrun. 

Upload performs no data verification. 

A file may be uploaded to a printer, PROM programmer, or other 
peripheral instead of to a host. In this case, there is no need to enter 
transparent mode before uploading. Just be sure the peripheral is ready to 
receive data. 

Refer also to Serial Communications, page 5-38. 
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UPLOAD SYMBOLS 



Command Result 



UPS All currently defined symbols 

and sections are sent to the 
computer port in extended 
tekhex format. 



Comments 



Extended tekhex restricts the number and range of characters that can be 
used for symbol names. When formatting symbols for upload, the 
Emulator truncates symbol names to 16 characters and substitutes [%| for 
characters not allowed by tekhex. 

Extended tekhex serial data format should be set before uploading symbols 
(SET parameter #26,5). 

When uploading to a file on a host system, enter transparent mode first and 
open a file to store the uploaded data records. (Review the Serial 
Communications discussion, pages 5-38 - 5-40.) 



Examples 



For UNIX: 



Cat ><filename> 
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UPLOAD SYMBOLS (cont.) 
For VMS: 



TYPE ><filename> 



(Create or EDT are also acceptable.) 
For CPM: 



PIP A:<filename> = RDR: 



Next, type the transparent escape sequence and begin uploading. 

After all data has been uploaded and the Emulator prompt returns, enter 
transparent mode and close the file by entering the appropriate control 
character. 

Remember to close the file before trying to view it. 
Refer also to Symbols, page 5-114. 
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COMMUNICATION WITH TARGET PROGRAMS 



Command 



Result 



COM <address> 



Establishes communication with 
the target program through a 
two-byte psuedo-port at the 
specified address. 

Exit COM mode by entering the 
two -character transparent mode 
escape sequence (see SET, page 
5-3). 



Comments 



Only useful during run mode. 

Affects real-time operation. 

Requires special target code. COM mode uses two bytes at the specified 
address. The byte at <address> is used for characters sent from the target 
to the controlling port. The byte at <address> + 1 is used for characters 
being sent to the target program. This command makes use of 7 -bit ASCII 
characters, with the eighth bit of each byte used for handshaking. 

To transmit a character to the ESI 800, the target program first checks the 
most significant bit (MSB) of the byte at <address>. If this bit is set (1), 
the Emulator has not yet collected the previous character. If the bit is 
cleared, the target program sets the MSB of the character to be transmitted 
and places the result in the byte at <address>. 

To receive a character from the Emulator, the target examines the byte at 
<address> + 1 . If the MSB of this byte is cleared, the Emulator has not yet 
transmitted a new character. If the MSB is set, the character is "new." If 
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COMMUNICATION WITH TARGET PROGRAMS (cont.) 



the controlling port of the ESI 800 is a terminal, the target program should 
echo the character by immediately copying it into the byte at <address> 
with the MSB still set. The target then program masks the MSB off and 
stores the result back at <address> + 1 . This prevents the target program 
from re-reading the same character. 

The COM routine does not check the byte at <address> + 1 to see if the 
target program has received it. Generally, the target program will be 
substantially faster than the COM routine and will always receive one 
character before the COM routine can transmit the next. 

In effect, the COM mode establishes a "transparent mode" between the 
running target program and the controlling port of the ESI 800. Whenever 
the ESI 800 reads target memory during run mode, it actually stops 
emulation for about 100 microseconds. To avoid significant impact on real 
time operation, the COM routine examines the byte at <address> only 
once every 0.5 seconds. When the COM routine discovers a new byte from 
the target program, it reads the byte and clears the location. The byte is 
then sent to the controlling port of the ESI 800. The COM routine then 
immediately returns to examine the byte at <address>. A target output 
routine has approximately 100 microseconds to place another character in 
the output location. If this 100 microsecond window is missed, the display 
of the subsequent character is delayed for 0.5 second. 

The flow diagram on the next page summarizes the COM process. 
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COMMUNICATION WITH TARGET PROGRAMS (cont.) 



Figure 6. Flow Chart 
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COMMUNICATION WITH TARGET PROGRAMS (cont.) 



Examples 



One good use of the COM command is to simulate a serial I/O port when 
debugging code before target hardware is available. The RUN command 
downloads the target program into overlay memory and enters run mode. 
The address supplied to the COM command is that of a simulated RS232 
data port. Data entered at the terminal is passed to the target program, and 
data output by the program appears on the screen. 



>MAP 


TO -1 




/* 


Map 


all 


avai lab I 


e overlay memory*/ 


>DNL 




















%cat serial. driver 




/* 


Download 


program 


to 


overlay 


*/ 


(enter 


transparent 


mode 


escape sequence) 














>RNV 






/* 


Run 


prog 


ram */ 








R>COM 


■serial_port 




/* 


Use 


serial data 


port 


as COM 


addr */ 



A note of caution: if a breakpoint or an error is encountered while running 
the COM command, the system will appear to hang up. This is because 
emulation has been broken, and the target program that receives and 
transmits characters is no longer running. Entering the transparent mode 
escape sequence will terminate COM mode and cause the break or error 
message to be displayed. 
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DISPLAY CHARACTER STRING 



Command 



Result 



DIA <address> 



Comments 



Reads and displays characters 
from target memory starting at 
the specified address. The DIA 
routine terminates when it reads 
soo| from target memory. 



Affects real time operation 
when entered in run mode. See 
pages 6-18, 6-19, 6-31. 



DIA is commonly used for test purposes in target systems that have no 
human- readable I/O channels. 

When a test routine detects a problem, it can load a register with the 
address of a null terminated error message. The routine then jumps to an 
address that causes the Emulator to break emulation. The DIA command 
can then be used to display the error message. 

DIA can also be used to check the contents of any null terminated string in 
memory. 
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DISPLAY CHARACTER STRING (cont.) 



Examples 



>BYM 




Make sure we're in byte mode. 


>M 120 




Enter Memory mode at address 120 


$000120 $00 


>48,65,6C,6C,6F,0 




$000126 $00 


>X 


Enter a null terminated string and exit 


>DIA 120 




Display string starting at 120 


Hello 
> 







This example sets a breakpoint in the target error routine. When the 
breakpoint occurs, a message pointed to by the ES:BX register pair is 
displayed. If the DX register is zero, the process stops. Otherwise, the 
ESI 800 immediately begins emulation and waits for another breakpoint 
and message. 



>AC1 = 'Error_stop 

>WHE AC1 THE BRK 

>* RBK;WAI;DIA ES:BX;TST = DX 
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Overlay Memory 

Overlay memory can be used to debug target hardware and software. It 
can be used to create and verify programs before hardware is available, 
determine whether the program is making illegal accesses, and patch target 
PROM code quickly and easily. 

Overlay memory is available in memory ranges from 32K to 512K. See 
your Applied Microsystems Corporation sales representative for 
incremental options. 

Overlay can be mapped in segments as small as 2K bytes. Each segment 
can be assigned one of four attributes; target, read/write, read only, or 
illegal. If memory is mapped, it means that you have assigned at least one 
segment of overlay as read/write, read only, or illegal memory. 
Unmapped memory is assigned the target attribute. Memory mapped as 
target or illegal does not use up overlay memory. 

When a segment of memory is mapped, program accesses in that memory 
range are directed to the overlay instead of the target. The overlay can be 
further qualified by the overlay enable register (OVE). This register 
indicates whether code, data, or all accesses in a mapped memory range 
should be directed to the overlay memory. 

Overlay memory accesses occur in real-time. No wait states are added by 
the Emulator at 10 MHz or below. 



5-62 



DISPLAY MEMORY MAP 



Command 



Result 



DM 



Displays the memory map 
currently in effect. 



Comments 



This command is valid only in pause mode. 



Examples 



>DM 

MEMORY MAP: 

$000000 TO $FFFFFF:TGT 



Default map at power-up. 

DM displays regardless of mode (physical or virtual). See page 6-2 for 
more information. 
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DISPLAY VIRTUAL MEMORY MAPPING LOG 



Command 



Result 



DML 



Displays the last 16 virtual 
memory mapping operations. If 
overlay memory is mapped 
using virtual addresses, the 
DML command shows the 
physical addresses that were 
mapped according to the 
descriptors that were valid at 
the time the memory mapping 
operation occured. The DML 
command allows the user to 
display the last 16 virtual 
memory mapping operations 
and includes the virtual address 
entered and the address of the 
physical memory that was 
mapped. If a protection error 
occurs while mapping, the 
mapping operation is not 
logged. If more than 16 
operations occur, the oldest 
entry in the log is overwritten. 

This is a history of the virtual 
memory operations and does not 
display the current memory map 
if physical mapping operations 
have occured. Please use the 
DM command (display map) for 
this information. 
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DISPLAY VIRTUAL MEMORY MAPPING LOG (cont.) 



If a modification is made to a 
descriptor table entry that was 
previously used in a mapping 
operation, the memory map is 
not altered to reflect this 
change. 

If a range is used with virtual 
addresses, each virtual address 
is converted to a physical 
address. The first is used as the 
start point and the second as the 
end point. Adjustments are 
made for 2K boundaries. If a 
single virtual address is used, it 
is converted to a physical 
address and when mapped, is 
adjusted for a 2K boundary. 



Examples 



The following is an example of a virtual mapping log: 



>DML 

VIRTUAL MAPPING LOG: 

ENTERED - MAP 0005:0000 TO 0005:2000 

ENTERED - MAP 0004:0000 TO 0004:1000 

ENTERED - MAP 000A:1000 TO 0000:0000 

ENTERED - MAP 0108:0400 TO 0560:0040 



MAPPED 


■ 000000 


TO 


0007FF : 


RO 


MAPPED 


■ 000800 


TO 


001FFF : 


RU 


MAPPED ■ 


010000 


TO 


012FFF : 


TGT 


MAPPED ■ 


004000 


TO 


0043FF : 


ILG 
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SET MEMORY MAP 



Command 



Result 



MAP <range> 



Maps the specified range and 
assigns it the default attribute 
type, RW. 



MAP <value> 



MAP <range>< attribute > 



Maps a 2K-byte block 
surrounding the specified value. 
Assigns the block the default 
attribute type, RW. 

Maps the specified range and 
assigns it the specified attribute 
type. 



MAP <value>< attribute > 



Maps a 2K-byte block 
surrounding the specified value. 
Assigns the block the specified 
attribute. 



Attributes 



RW 



Memory mapped as read-write (RW) responds like 
normal overlay memory. The overlay memory is high 
speed and may actually run faster than target system 
memory if that memory normally asserts wait states. 

RW is the most common attribute and is therefore the 
default. MAP commands that do not specify an 
attribute default to RW partitions. 
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SET MEMORY MAP (cont.) 



RO Memory mapped as RO acts like read-only memory to 

the target program. If the program attempts to write to 
this memory, the ESI 800 aborts run mode and displays 
the error message, MEMORY WRITE VIOLATION. 
The contents of RO overlay cannot be altered by a 
running target program. 

The same comments about speed given in the paragraph 
on RW apply to memory mapped as RO. You can 
always modify memory mapped as RO (in pause mode) 
even though the target program (run mode) cannot. 

ILG Memory mapped as illegal can be used to mark address 

ranges that should not be accessed by the target 
program. Any access to an address range mapped as 
ILG causes the ESI 800 to abort run mode and display 
the error message, MEMORY ACCESS VIOLATION. 
Memory mapped as ILG does not use up available 
overlay memory. 

TGT The ESI 800 ignores accesses in address ranges mapped 

with this attribute. Memory that is not explicitly 
mapped is defaulted to TGT. 



Comments 



Overlay memory is mapped in segments of 2K bytes. When you specify an 
address or a range to be mapped as RW or RO, the mapping outline 
allocates the minimum number of 2K segments that will completely 
enclose the address(es) of interest. 

There is a distinction between the overlay map and overlay memory. If 
your system has any overlay memory installed (it is an option), you have a 
complete overlay map and some limited amount of overlay memory. The 
overlay map covers the entire address space (24 bits). The overlay map is 
used to logically place segments of overlay memory anywhere throughout 
the address space. 
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SET MEMORY MAP (cont.) 



You can save and restore the contents of the overlay map by using the 
EEPROM LD/SAV commands (see pages 5-34 and 5-36). You cannot save 
the contents of overlay memory in EEPROM. 



Examples 



The following command sequence might reflect a common mapping: 



Command 


Comments 


>CLM 


Clear map to al I TGT 


>MAP TO -1:ILG 


Default entire address space to Illegal 


>LDV 


Sets CS:IP to 0FFFF0 (reset vector) 


>MAP CS:IP:RO 


Map ROM for reset vectors 


>MAP 'RAM_start LEN 20000 


Map some overlay memory to work with 


>MAP 'I/C_start:TGT 


Have I/O already in target space 


>MAP LEN 800 


Allocate RAM for interrupt vectors 


>DM 


Display what we've done 


MEMORY MAP: 




MAP $000000 TO $0007FF:RW 


Interrupt Vectors 


MAP $000800 TO $00FFFF:ILG 




MAP $010000 TO $02FFFF:RW 


Working RAM 


MAP $030000 TO $03FFFF:ILG 




MAP $040000 TO $0407FF:TGT 


I/O space 


MAP $040800 TO $0FF7FF:ILG 




MAP $0FF800 TO $0FFFFF:RO 


Reset vectors 


MAP $100000 TO $FFFFFF:ILG 
> 
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SET MEMORY MAP (cont.) 



Since the contents of overlay memory are not affected by changing the 
overlay map, you can compare the operation of a program in target 
memory with one in overlay memory. 



Command 



Comments 



>CLM 

>MAP 1000 to 7FFF:R0 
>LOV 1000 to 7FFF 
>ASM 2000 

(Assembler commands) 
>RNV 

>STP;MAP 1000 TO 7FFF:R0;RVN 
>STP;MAP 1000 to 7FFF:R0;RNV 



Clear any previous mapping: 
Map ROM over existing target program 
Copy target program into overlay memory 
Use line assembler to make a patch 



Run patched version 

Stop, Remove map, Run normal version 

Stop, Restore map, Run patched versi 



on 



If you do not have target memory but you still want to compare two 
programs, you can use a trick of overlay memory allocation. This example 
assumes you have 128K or more of overlay memory. 



Command 



>CLM;MAP 0FFFF0:RO 
>GR0 = 1000 LEN 8000 
>MAP GR0 
>DNL 

(Download commands and records) 
>MAP GR0:TGT 



>MAP GR0 + 10000 



>MAP GR0 

>DNL 
(Download commands and records) 

>MAP GR0:TGT;MAP GRO + 20000 
>MAP GRO + 1 0000 :TGT; MAP GRO 



Comments 



Need Reset Vector mapped as ROM 
Will save some typing 
Map 32K bytes for code space 
Download first program into overlay 

Unmap code space (The data is still 

in overlay memory) 

Remap but at higher address range. 

The first program now "exists" again 

but in a higher address range. 

Now map more overlay at the normal 

range 

Download second program. 

Now you have a copy of both programs. 
Relocates second program out of the way 
Relocates first program back to normal 
address range. 
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CLEAR MEMORY MAP 



Command Result 



CLM The entire address range is 

assigned the TGT attribute. 



Comments 



This command clears all addresses from the overlay map. 
This command is valid only in pause mode. 
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LOAD OVERLAY MEMORY 



Command Result 



LOV <range> Moves data from the target 

system memory to the Emulator 
overlay memory in the specified 
address range. 



Comments 



This command is valid only in pause mode. 

In order to load overlay memory from the target memory, you must have a 
target system interfaced with the ESI 800 Emulator and have overlay 
memory installed and mapped. 

In order to load a target memory range into the overlay memory at a 
different address, use the LOV command, then do a block move (BMO) of 
the data. 
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VERIFY OVERLAY MEMORY 



Command 



Result 



VFO <range> 



Compare the specified range in 
the target memory to the same 
range in the overlay memory. 

If there are no differences 
between the data in the overlay 
and target, the Emulator 
prompts you for the next 
command. 

If there are any differences, the 
address of each difference 
displays: 



<ADDRESS> = XX NOT YY 



Comments 



XX denotes the data present in 
overlay memory. IT is the data 
at that location in the target 
system memory. 



This command is valid only in pause mode. 
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SET OVERLAY SPEED 



Command Result 



OVS <value> The OVS command allows the 

user to set the number of wait 
states to be inserted in each bus 
cycle when accessing overlay 
memory. The RDY switch must 
be ON. OVS accepts values of 
$0 to $0E. 
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Registers 

The following is a complete list of all the registers in the Emulator. These 
registers can be logically divided into three groups: 

■ microprocessor registers 

■ general Emulator registers 

■ Event Monitor System registers 

Each register accepts one or two of three value types: 

■ integer values 

■ range values 

■ don't care values 

Registers that accept range and don't care types can also be assigned 
integer values. 
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Section 5: System Commands 



Microprocessor Registers 



Name 



Description 



Type Length (bits) 



AX, AL, AH 

BP 

BX, BL, BH 

CS 

CSA 

CSB 

CSL 

CX, CL, CH 

DI 

DS 

DSA 

DSB 

DSL 

DX, DL, DH 

ES 

ESA 

ESB 

ESL 

FLX 

GDB 

GDL 

GDTR 

IDA 

IDB 
IDL 
IP 
LDA 

LDB 
LDL 
LDT 
LDTR 



accumulator (low and high) Int 

base pointer Int 

base register (low and high) Int 

code segment Int 

code segment access rights Int 

code segment base Int 

code segment limit Int 

count register (low and high) Int 

destination index Int 

data segment Int 

data segment access rights Int 

data segment base Int 

data segment limit Int 

data (low and high) Int 

extra segment Int 

extra segment access Int 

extra segment base Int 

extra segment limit Int 

flags register Int 

global descriptor table base Int 

global descriptor table limit Int 

= GDB + GDL Int 
interrupt descriptor table 

access rights Int 
interrupt descriptor table base Int 
interrupt descriptor table limit Int 

instruction pointer Int 
local descriptor table 

access rights Int 

local descriptor table base Int 

local descriptor table limit Int 

local descriptor table register Int 

local descriptor table register Int 
= LDA + LDB + LDL 



16,8,8 

16 

16,8,8 

16 

8 

24 

16 

16,8,8 

16 

16 

8 

24 

16 

16,8,8 

16 

16 

24 

16 

16,8,8 

24 

16 

16 

8 

24 
16 
16 

8 

24 

16 

16 

16 
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Microprocessor Registers (cont.) 



Name 



Description 



Type Length (bits) 



machine status word 

source index 

stack pointer 

stack segment 

stack segment access rights: 

stack segment base 

stack segment limit 

task access rights 

task base 

task limit 

task register 



MSW 

SI 

SP 

ss 

SSA 

SSB 

SSL 

TA 

TB 

TL 

TR 



Int 


16 


Int 


16 


Int 


16 


Int 


16 


Int 


8 


Int 


24 


Int 


16 


Int 


8 


Int 


24 


Int 


16 


Int 


16 



General Emulator Registers 



Name 


Description 


Type 


Length (bits) 


ADF 


force address register 


Int 


4 


DFB 


default base 


Int 


8 


GD0-GD7 


general purpose data 


DC 


32 


GR0-GR7 


general purpose range 


Range 


32 


IOP 


I/O mode pointer 


Int 


16 


MMP 


memory mode pointer 


Int 


32 



5-76 



Section 5: System Commands 



Event Monitor System Registers 



Range 


24 


Range 


24 


Int 


16 


DC 


16 


DC 


16 


DC 


16 


DC 


16 


DC 


16 


Int 


32 



Name Description Type Length (bits) 

AC1.1-AC1.4 address comparator 

AC2.1-AC2.4 address comparator 

CTL.1-CTL.4 count limit comparator 

DC1.1-DC1.4 data comparator 

DC2.1-DC2.4 data comparator 

LSA.1-LSA.4 logic state comparator 

SI .1 -SI .4 status comparator 

S2 . 1 - S2 .4 status comparator 

SIA special interrupt address 

(real mode) 
SIA special interrupt address Int 32 

selector: offset (virtual mode) 

Each register has a separate display base. The display base is viewed and 
changed with the BAS command (see page 5-83). Display bases are often 
changed for registers such as the Event Monitor LSA comparators, which 
you might like to see in binary, and the CTL register, which you might 
want to see in decimal. 

The CPU registers and the Event Monitor registers ban be displayed as a 
group by using the DR and DES n commands. 

See Event Monitor System (Section 7) for Event Monitor System Register 
descriptions. 

The complete register set can be loaded from or saved to EEPROM. 
Executing a SAV or LD copies all system variables. A SAV 1 or LD 1 
copies only the register group. 
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DISPLAY/LOAD MICROPROCESSOR REGISTERS 



Command 



Result 



DR 



Displays values of all 
microprocessor registers. 



>DR 
CS:IP 
F000:FFF0 



FLX 



AX BX CX DX DS SI ES DI BP SS SP 
0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 



<register name> 



Displays the value of the 
specified microprocessor 
register in its display base. 



<register name>=<exp> 



Assigns the specified register 
the value <exp>. 



CLR 



Clears, the four CPU data 
registers; AX, BX CX, and DX. 



LDV 



Loads the reset vectors into the 
CS, IP and FLX registers. The 
reset vectors can also be loaded 
by the RNV and RBV 
commands. These load the 
vectors and enter run mode 
(page 6-21). 
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DISPLAY/LOAD MICROPROCESSOR REGISTERS (cont.) 



Comments 



On power-up an LDV command is automatically executed. This command 
sets the registers to Intel-defined default values. Register values may be 
saved to and loaded from EEPROM. 

The CPU registers are automatically copied from Emulator overlay mem- 
ory to the microprocessor when run mode is entered. When emulation is 
broken, they are copied from the processor to Emulator overlay memory. 

If a CPU register is loaded with a value during run mode, a warning 
message is to be displayed. This warning informs you that the value you are 
entering will not be sent to the pod CPU during emulation. The value is 
stored in the Emulator's internal memory, but when emulation is broken, 
the new value of the CPU register overwrites the value just entered. 

The display of the FLX register is different from that of the other CPU 
registers. The flags are more conveniently decoded by using an alpha 
character to indicate whether the flag was set or cleared by a particular 
instruction cycle. If the flag is clear, you see a Q as a place holder. If set, 
the following characters describe the flag. 



N - Nested task 

- Overflow „ 

D - Direction |\i? , u <• 

1 - Interrupt < t ' * K O t>X T 1 S £ X (\ \ X ?X c| 

T - Trap J [ l 

S - Sign 

Z - Zero 

A - Auxi llary carry 

P - Parity 

C - Carry 



If FLX were assigned the value SFFFF, the DR command would display the 
FLX register as: 



>DR 






CS:IP 


FLX 


AX BX CX DX DS SI ES DI BP SS SP 


0000:0000 


N0DITSZAPC 


0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 



(continued) 
5-79 



DISPLAY/LOAD MICROPROCESSOR REGISTERS (cont.) 



Examples 



Load the data segment and verify that it contains the correct value. 



>DS=$A700;DS 
$A700 
> 
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DISPLAY/LOAD MMU REGISTERS 



Command 



Result 



DRL 



Displays values of all memory 
management registers as well as 
all microprocessor registers. 



Examples 



>DRL 


















IP 


AX 


BX 


CX 


DX SI 


DI 


BP 


SP 




FFFO 


0000 0000 


0000 


0000 0000 0000 


0000 


0000 




FLX = 






IOP = n 


MSW = 


ACCESS 




REG 


INDEX 


TI 


RPL 


BASE 


LIMIT 


DPL 


CS 


1E00 


G 





FF0000 


FFFF 


PCD 


U W 


. 


DS 


0000 


G 





000000 


FFFF 


PCD 


U W 


. 


ES 


0000 


G 





000000 


FFFF 


PCD 


U W 


. 


SS 


0000 


G 





000000 


FFFF 


PCD 


U W 





GDTR 
LDTR 


0000 


G 





000000 
000000 


0000 
0000 








. C D 


U . 





IDTR 
TR 


■ ■ ■ m 

0000 


G 





000000 
000000 


FFFF 
0000 








. C D 


U . 
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DISPLAY/LOAD MMU REGISTERS (cont.) 



Comments 



The memory management unit translates logical addresses to physical 
addresses, based upon information found in the descriptor table. The CS, 
DS, ES, SS, GDTR, LDTR, IDTR, and TR show the contents of the most 
recently used descriptor table entry for each appropriate group. 
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SET/DISPLAY REGISTER DEFAULT BASE 



Command 



Result 



BAS <register> 



Displays the decimal base of the 
specified register. 



BAS <register>- <base value> 



Comments 



#0 


- default 


#2 


- binary 


#8 


- octal 


#10 


- decimal 


#16 


- hexadecimal 



If the register has not been 
assigned a separate display base, 
the current default base is 
displayed. 

Sets the display base of the 
register to the base value. 

If the base value for a register is 
set to 0, the current default base 
is used for display. 



Base values may be stored in EEPROM and automatically loaded on 
power-up or manually retrieved using the LD or LD 1 command. 

Be careful when setting private display bases to unusual bases such as 4, 7, 
or 1 1. The Emulator operates correctly, but the results may be confusing. 
If you set the base value to a value other than hexadecimal, decimal, octal, 
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SET/DISPLAY REGISTER DEFAULT BASE (cant.) 



or binary, the Emulator displays a question mark (0) preceding the base 
value when asked to display the base in effect. 

Refer to the default base command, DFB (page 5-88), to display the 
system global default base. 



Examples 



>BAS FLX 
>#16 



The value of GD3 is displayed in binary until you change its display base 
or power down the Emulator. 



>GD3 

$0000AA55 

>BAS GD3 = 2 

>BAS GD3 

#2 

>GD3 

%00000000000000001010101001010101 
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MEMORY MODE POINTER 



Command Result 



MMP Displays the current value of 

the memory mode pointer. 

MMP = <exp> Assigns the value <exp> to the 

memory mode pointer. 



Comments 



The MMP is the last address examined while in memory mode. If you 
enter memory mode without specifying an address, the MMP value is used 
as the entry point. 

The default power-up value of the MMP register is zero. This register 
may be saved to and loaded from EEPROM. 

The memory mode pointer is automatically modified when you scroll to a 
new address after entering memory mode. When you exit memory mode, 
the MMP reflects the last address examined. For more information on 
memory mode, see page 6-52. 
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MEMORY MODE POINTER (cont.) 



Examples 



Sets an address comparator to the last address examined in memory mode. 



>M 6000 




















(examine 


memory 


unt i I 


you 


find 


a 


locat 


ion 


of 


interest) 


$006013 5A 


>X 


















>AC1=MMP 
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I/O MODE POINTER 



Command 



Result 



IOP 



Displays the current value of 
the I/O mode pointer. 



IOP = <exp> 



Assigns the value <exp> to the 
I/O mode pointer. 



Comments 



The IOP is the last value examined while in I/O mode. If you enter I/O 
mode without specifying an address, the IOP value is used as the entry 
point. 

The default power-up value of the IOP register is zero. This register may 
be saved to and loaded from EEPROM. 

The I/O mode pointer is automatically modified when you scroll to a new 
address after entering I/O mode. When you exit I/O mode, the IOP 
reflects the last address examined. For more information on I/O mode, see 
page 6-52. 
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DEFAULT BASE 



Command 



Result 



DFB 



Displays the global default base. 

On power-up the default base is 
hexadecimal unless another 
default base was loaded by the 
EEPROM on power-up. 



DFB = #2 
DFB = #8 
DFB = #10 
DFB = #16 



Sets the default base to binary. 

Sets the default base to octal. 

Sets the default base to decimal. 

Sets the default base to 
hexadecimal. 



Comments 



Specific operators determine the base of the input value: 



Operator 

<%> 
<\> 
<#> 
<$> 


Description 

Binary 
Octal 
Decimal 
Hexadecimal 


Example 

%1001 1100001111 
\23417 
#9999 
$270 F 
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DEFAULT BASE (cont.) 



Base prefixes can be used any time to enter a value in a base different from 
the default base. Values not preceded by one of these prefixes are 
presumed by the Emulator to be in the default base. 

For example, if you set the global default base to binary, and you then 
want to assign a value to a register in a base other than binary, use a base 
prefix. 

The Emulator works correctly with any base between 2 and 16. However, 
if you set an uncommon base, such as 5 or 9, the results of assignments and 
commands may be confusing. 

If the base is outside the allowable range, an error message is displayed and 
the Emulator defaults to the hexadecimal base. 
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GENERAL PURPOSE DATA REGISTERS 



Command 



Result 



GV<0-7> 



Displays the value of the 
specified register. 



GD<0-7> = <value> 



Assigns a value to one of the 
eight general purpose data 
registers. 



Comments 



Use the general purpose registers as arguments to commands to save 
keystrokes when using values repeatedly. They can also be used to save 
space in macro definitions. 

These general purpose registers may be used in place of integer or don't 
care values in command statements. 

The general purpose data registers can be loaded with any integer or don't 
care value. They will not accept a range value. 



Examples 



General purpose data register 4 is loaded with 5000. GD4 can now be used 
anywhere you would use this integer value. 



>GD4 = 5000 
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GENERAL PURPOSE DATA REGISTERS (cont.) 



If you are looking for a specific pattern on the LSA pod lines in more than 
one event group, assign a general purpose data register the value you are 
looking for. All subsequent LSA assignments can use this register. 



>GD2 = %01 100101 100 DC % 10011 




>LSA = GD2; LSA. 2 = GD2 




>GD3 = 'datpatl DC %FF00 


Looking for one byte 


>DC1 = GD3 


of a specified word? 



If you have a hard time remembering the memory mode status mnemonics, 
use a general purpose register instead. 



>GD6 = ALT 




>MMS = GD6 




>GD1 = OVL+RD+IOA 


To set-up a breakpoint on an overlay 


>S1 = GD1 


read from I/O space. 
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GENERAL PURPOSE ADDRESS REGISTERS 



Command 



Result 



GR<0-7> 



GR<0-7> = <value> 



Displays the value of the 
specified register. 

Assigns a value to one of the 
eight general purpose address 
registers. 



Comments 



Use the general purpose registers as arguments to commands to save 
keystrokes when using values repeatedly. They can also be used to save 
space in macro definitions. 

These general purpose registers may be used in place v of integer or range 
values in command statements. 

The general purpose data registers can be loaded with any integer or range 
value. 



Examples 



General purpose address register 4 is loaded with 5000. GR4 can now be 
used wherever you would use this integer value. 



>GR4 = 5000 
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GENERAL PURPOSE ADDRESS REGISTERS (cont) 



Assign a register a range you will be using often. Then use it as a parameter for 
other commands. 



>GR0 = 'start_code LEN 20 
>DIS GRO 
>DB GRO 



If you do not know the absolute address in your target hardware, but have 
downloaded a symbol table containing them, then use the symbol names instead of 
looking up the hardware specifications. 



>GR2 = 'RAM_START LEN 8000 Initialize GR2 

>SF 0,GR2 Run a test on your overlay memory 

>AC1 = GR2 set a breakpoint on any overlay 
>WHE AC1 THE BRK memory access in the range of GR2 
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TEST REGISTER 



Command 



Result 



TST 



Stops repeating commands. The 
text register is set to an 
expression in a command line. 
When it becomes zero, the 
repeat halts. 



Comments 



See Repeat Operators (page 5-1 10) for more detailed information. 
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Section 5: System Commands 



Trace Memory 

During emulation, the activity of the executing program is recorded and 
stored in trace memory. All address lines, data lines, processor status lines, 
and 16 bits of external logic-state are traced. This record becomes a 
history of the program. If something unexpected happens during program 
execution, trace memory can be reviewed to determine what exactly took 
place. When used in conjunction with the trace disassembler, hardware 
and software problems may be found. 

Although you cannot access trace memory during emulation, you can stop 
program execution at any point, either manually, or by using the Event 
Monitor System. The address, data, and control signals of the most 
recently traced cycles may be reviewed. 

Trace memory commands deal with the display and disassembly of trace 
memory data. Refer to the Event Monitor System (Section 7) for 
sophisticated uses of trace memory. 

Trace memory is 71 bits wide and 2046 bus cycles deep. Some bus cycles 
may be used for marks to identify start and stop points within the trace 
buffer. An unqualified trace contains all bus activity for the last 2046 bus 
cycles. 

NOTE: The sequence numbers in DT, DTB, and DTF (instructions) 
correlate with the line numbers displayed in the DRT (bus cycles). 
However, one or more bus cycles in the DRT display may make up one 
instruction on the DT, DTB or DTF displays. These displays may have 
missing sequence numbers indicating that a multiple bus cycle instruction 
has been executed. Also, the sequence number (SEQ #) may be repeated 
when two-byte wide instructions were executed from contiguous 
addresses. 
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DISPLAY RAW TRACE BUS CYCLES 



Command 



Result 



DRT 



Displays the last page of bus 
cycle:? recorded in trace 
memory. 



DRT <line number •> 



Displays a page of the trace 
buffer starting with <line 
number >. 



DRT <range> 



Displays the range of line 
numbers. XON and XOFF may 
be used to start and stop 
scrolling if the range is larger 
than the console display. 

Note that the range is a range of 
bus cycles, not the address 
recorded in the trace memory. 



Comments 



SET parameter #13 sets the page length. Refer to SET (page 5-3). 
This command is valid only in pause mode. 
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Examples 



DISPLAY RAW TRACE BUS CYCLES (cont.) 



>RUN 
























R>STP 
























CS:IP = $000334 


















GROUP 


1 






















>DRT 
























LINE 


ADDRESS 




DATA 


R/W 


MEM 


M/IO 


BCYC 


EA 


QFL 


LSA - 8 


7 - 


#20 


00033A 


> 


23 FF 


R 


TAR 


M 


IF 


8 




%11111111 


%1 1 1 1 1 1 1 1 


#19 


00033C 


> 


7400 


R 


TAR 


M 


IF 


8 




%1 1 1 1 1 1 1 1 


%11111111 


#18 


000333 


> 


4B 


R 


TAR 


M 


IF 


9 


QF 


%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


#17 


000334 


> 


FD75 


R 


TAR 


M 


IF 





QF 


%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


#16 


000336 


> 


F9E2 


R 


TAR 


M 


IF 


4 




%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


#15 


000338 


> 


3E80 


R 


TAR 


M 


IF 


4 




%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


#14 


00033A 


> 


23 FF 


R 


TAR 


M 


IF 


8 




%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


#13 


00033C 


> 


7400 


R 


TAR 


M 


IF 


8 




%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


#12 


000333 


> 


4B 


R 


TAR 


M 


IF 


9 


QF 


%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


#11 


000334 


> 


FD75 


R 


TAR 


M 


IF 





QF 


%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


#10 


000336 


> 


F9E2 


R 


TAR 


M 


IF 


4 




%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


# 9 


000338 


> 


3IE80 


R 


TAR 


M 


IF 


4 




%11111111 


%1 1 1 1 1 1 1 1 


# 8 


00033A 


> 


23DF 


R 


TAR 


M 


IF 


8 




%11111111 


%11111111 


# 7 


00033C 


> 


7400 


R 


TAR 


M 


IF 


8 




%11111111 


%1 1 1 1 1 1 1 1 


# 6 


000333 


> 


4B 


R 


TAR 


M 


IF 


9 


QF 


%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


# 5 


000334 


> 


FD75 


R 


TAR 


M 


IF 





QF 


%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


# 4 


000336 


> 


F9E2 


R 


TAR 


M 


IF 


4 




%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


# 3 


000338 


> 


3E80 


R 


TAR 


M 


IF 


4 




%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


# 2 


00033A 


> 


23 FF 


R 


TAR 


M 


IF 


4 




%11111111 


%11111111 


# 1 


00033C 


> 


7400 


R 


TAR 


M 


IF 


4 




%1 1 1 1 1 1 1 1 


%1 1 1 1 1 1 1 1 


# 


BREAK 























LINE 



Line number in the trace buffer indicates the last 
bus cycle prefetched or executed before the 
Emulator went into pause mode. The larger the line 
number, the further back in the history of the 
program you are viewing. You can get a good idea 
of the relationship of bus cycles to instructions by 
matching the bus cycle line numbers in the DRT to 
the SEQ# in the disassembled trace. 
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DISPLAY RAW TRACE BUS CYCLES (cont.) 



ADDRESS 



DATA 



MEM 



M/IO 



BCYC 



The memory address or location where the 
instruction was fetched. The addresses in the raw 
trace represent physical addresses. 

The address displayed is where the bus cycle took 
place, along with the data written to or read from 
that address. The addresses in the raw trace ( DRT) 
represent physical addresses. 

El and [<] are data direction indicators. They 
indicate whether data was read from an address 
( ) or written to an address ( )• These same 
indicators are used in the trace disassembly. 

MEM indicates whether the access was in the target 
memory area or in the Emulator's overlay memory 
(see DM command to determine what addresses are 
mapped). 

M/IO indicates whether the bus cycle access was a 
memory access (M) or an I/O access (IO). This is 
determined by the program. 

BCYC indicates what type of bus cycle was run. 
This is determined by your program. The 
possibilities are: 



HSD 


halt shutdown 


IAK 


interrupt acknowledge 


IF 


instruction fetch 


LK 


locked bus cycle 


NBC 


no bus cycles 


PE 


processor extension cycle 


RIO 


read from I/O 


RM 


read memory 


UIO 


write to I/O 


WM 


write memory 



EA 



Indicates the four least significant bits of those 
instructions that were executed. Not: all addresses 
of instructions executed are traced, because of the 
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DISPLAY RAW TRACE BUS CYCLES (cont.) 



asynchronous nature of executed address vs. 
prefetched information. Information is stored in 
trace at the end of each bus cycle. Several 
instructions can be executed during each bus cycle. 
Only the last instruction executed before the end of 
the bus cycle is executed. 

R/W R/W indicates whether the bus cycle access was a 

read or write cycle. This is determined by the 
program. 

QUE QUE indicates how many bytes (up to 6) are in the 

processor queue or how many were "flushed" 
(usually caused by a branch). A flush is indicated 
by a |o] preceding the queue depth value. 

LSA-8 7-0 LSA-8 7-0 columns display the state of each pin of 
the LSA pod during that bus cycle. 

NOTE: The same information that is recorded in 
the trace buffer can be used by the Event Monitor 
System to cause event actions. Therefore, 
everything in the trace buffer such as QUE flushes 
or WIO or any combination of these traced items 
can cause event actions such as selective tracing, 
counting, or breaking emulation (refer to the Event 
Monitor System, Section 7). 



5-99 



DISASSEMBLE TRACE MEMORY 



Command 



Result 



DT 



Disassembles and displays the 
last instruction in trace memory. 
A sequence number is not 
included. Overwrites current 
display line. 



DT <range> 



Disassembles a range of bus 
cycles, starting at the specified 
value and proceeding back in 
time. 



DT <value> 



Disassembles a page of trace 
starting at <value>. 



Comments 



This command is valid only in pause mode. 

A page is defined by the CRT length parameter in the SET menu. 

The sequence #0 is always the most recently recorded bus cycle in trace 
memory. If an argument is specified to the DT command, the values refer 
to the raw trace sequence numbers. 

The sequence number shown is a decimal value. For numbers larger than 
9, precede with a decimal ( [#| ) base sign. 

When using the disassemble trace (DT) and the display register (DR) on the 
same line, make sure you enter DT before DR, because DT will overwrite 
the current line. It does this so that the STP;DT command used repeatedly 
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DISASSEMBLE TRACE MEMORY (cont.) 



will give a listing similar to a program listing without the STP;DT line 
between each command. 



Examples 



These two commands used in conjunction will produce output similar to a 
program listing. 



>STP;DT 
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ES 1800 Emulator Reference Manual for 80286 Series Microprocessors 





>DTB 












PARTIAL TRACE 


MEMORY MAP 








SEQ# 


ADDR 


LOG ADDR 


DATA MNEMONIC OPERANDS BUS CYCLE DATA 


0084 


00086B 


0002:0098 


C745020000 


MOV 


WORD PTR CD 1+2] ,0000 
0003:0C82<0000 


0080 


000870 


0002:00A0 


C745040292 


MOV 


WORD PTR CD 1+43 ,9202 
0003:0084<0292 


0071 


000875 


0002:00A5 


C745060000 


MOV 


WORD PTR CD 1+6], 0000 
0003:0086<0000 


0067 


00087A 


0002:00AA 


0F01E0 


SMSU 


AX 


0065 


00087D 


0002:00AD 


0D0100 


OR 


AX, 0001 


0057 


000880 


0002:00B0 


0F01F0 


LMSW 


AX 


0056 


000883 


0002:00B3 


EB01 


JMP 


SHORT 002182 


0052 


000886 


0002:00B6 


90 


NOP 




0052 


000887 


0002:0087 


EA8C080800 


JMP 


FAR PTR 0008:088C 0003 : 006O009E 
0003:0068>0010 0003 :: 006A>0000 
0003:006C<009F 


0037 


00088C 


0002:00BC 


B81800 


MOV 


AX, 001 8 


0036 


00088F 


0002:00BF 


8ED0 


MOV 


SS,AX 0003:00700092 
0003:0CI78>0080 0003 :: 007A>0000 
0003:007C<0093 


0035 


000891 


0002:00C1 


B81000 


MOV 


AX, 0010 


0033 


000894 


0002:00C4 


8ED8 


MOV 


DS,AX 0003:0074>0092 
0003:0070>0010 0003 :: 0072>0020 
0003:0074<0093 


0032 


000896 


0002:00C6 


90 


NOP 




0032 


000897 


0002:00C7 


90 


NOP 




0021 


000898 


0002:00C8 


90 


NOP 




0021 


000899 


0002:00C9 


90 


NOP 




0020 


00089A 


0002:00CA 


90 


NOP 




0020 


00089B 


0002:00CB 


90 


NOP 




0019 


00089C 


0002:00CC 


90 


NOP 




0019 
> 


00089D 


0002:00CD 


90 


NOP 
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DISASSEMBLE TRACE MEMORY (cont.) 



SEQ# 



ADDR 
OPCODE 

MNEMONIC 

OPERAND FIELD 
BUS CYCLE DATA 



Correlates the disassembled instruction to 
the raw trace bus cycle. 

This is a decimal number and must be 
preceded by a [#] sign when referenced for 
selective disassembling of the trace. This 
corresponds to the line number in the DRT 
command display. 

The memory address or location where the 
instruction was fetched. 

The machine-language (hex number) 
equivalent of the following assembly- 
language instruction. 

The command used to invoke the 
instruction. 

The assembly-language instruction. 

The bus cycle transaction, if any, that 
occurred as a result of the instruction. This 
includes any information written to, or read 
from, memory or I/O locations. 
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DISASSEMBLE TRACE PAGE 



Command 



Result 



DTB 



Disassembles the previous page 
of trace memory (from current 
trace memory pointer). 



DTF 



Disassembles the following page 
of trace memory (from the 
current trace memory pointer). 



Comments 



This command is valid only in pause mode. 

A page is defined by the CRT length parameter in the SET menu. Three 
lines are subtracted for header and prompt lines. 

Refer also to the DT command, page 5-100, the DRT command, page 
5-96, and the slash command, page 5-113. 
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Section 5: System Commands 



Macros 

A macro defines a list of commands or expressions that are executed with 
one command key word. This allows you to execute repetitive operations 
quickly and easily. 

You can define up to ten macros. They are referred to by the decimal 
numbers #0-9. The ten macros are linked in one buffer with #1 first, 
#2... #9, and #0 last. 

If the lengths of all ten macros exceeds the buffer length of 125 characters, 
the highest numbered macro is truncated. Spaces are also considered 
characters, so use them only when required, to save macro buffer space. 



Examples 



If macros #1 to #8 are defined and in this process use up all of the space in 
the buffer, then an attempt to define macro #9 and #0 results in those 
macros remaining null. Also, if the length of any macro from #1 to #7 is 
increased after filling the buffer, then macro #8 will be truncated. If the 
increase is more than the size of macro #8, macro #8 becomes null and 
macro #7 is truncated. 

WARNING! 

There are no warnings when truncation or nullification takes 
place. 

When you define a number of long macros, execute the MAC command to 
determine if the macros of the highest numbers are still intact. Using the 
general purpose registers in macros helps minimize the number of 
characters you need to use. 

Macros can be saved in the Emulator EEPROM. Refer to the LD and SAV 
(pages 5-34 and 5-36) commands for information on saving and reloading 
macros. 
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DISPLAY DEFINED MACROS 



Command 



Result 



MAC 



Displays all defined macros in 
order #1-9,0 identified by three 
character sequences. 



Examples 



>_1=DR;DIS CS:IP LEN 4; RUN 

>_2=DB; SS:SP LEN 10;a'Data_ptr 

>MAC 
_1=DR;DIS CS:IP LEN 4; RUN 
_2=DB; SS:SP LEN 10;a'Data_ptr 

> 
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DEFINE/EXECUTE MACROS 



Command 



Result 



_<0-9>= <com, exp, op> 



Defines the specified macro. 



<0-9> 



Executes the specified macro. 



Comments 



A space between the underscore, digit, or equals sign causes an error. 

There are shorthand notations for two macros: a comma as the first 
character on a line executes macro #1 and a period as the first character on 
a line executes macro #2. 



Examples 



Three macros are defined. Macros #1 and #2 can be executed 
independently. Macro #3 contains two nested macros (#1 and #2). 

Macros are not expanded when the macro is defined, so the definition of 
macro #3 may change, depending upon the content of macros #1 and #2. 

In this example, macro #2 uses a general purpose register as a counter. 



>_1=STP;DT 
>_2=GD1=GD1+1 

>_3=_1;_2 
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DEFINE/EXECUTE MACROS (cont.) 



Step and disassemble one instruction at a time. 



>_1= DB SS:SP LEN 20;RET;DIS CS:IP LEN 12 



Display the first 20H bytes on the stack, skip a line for readability and 
disassemble the next instructions that will be executed. 

There is no display on the screen and no syntax checking when a macro is 
defined. Errors are detected only when the macro is executed. 

Macro #3 is executed. 



> 3 
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CLEAR MACROS 



Command 



Result 



CMC 

<0-9>= 



Examples 



Clear macro #1, 



> 1= 



Clears all defined macros. 



Clears the specified macro. 
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The Repeat Operators 

The command repeat feature provides a way to repeat a command line a 
specified number of times or indefinitely. A repeat is indicated by an 
asterisk ( ) at the beginning of a command line. The asterisk is followed 
by an optional decimal argument to specify the number of times to repeat 
the buffer contents. If the argument is zero, the buffer content is not 
executed. 



Examples 



>*5STP;DT 
>*5 STP:DT 
>* 5 STP;DT 



In these three equivalent examples, the STP;DT command is repeated five 
times. If the slash key is typed after the above example is input, the entire 
line is repeated, causing five more STP;DT commands to be executed. 

The repeat argument must be specified in decimal, not in hex, or as a 
variable, and there must be a space following the repeat count if the next 
character is a decimal digit. 

When the repeat argument is not specified it is assumed to be 
4,294,967,295 (2 32 -l). A repeat can always be terminated by executing a 
system reset. However, this will also abort emulation, if it is in progress, 
without saving the state of the CPU. 

The TST register terminates a repeats by setting it to zero with an 
expression in the command line. It is tested just before the command line 
is executed and if it has become zero, the command buffer is not executed 
and the repeat halts. 

To single step and disassemble until a specified address is reached: 



>*STP;DT; TST=CS:IP-$C324 
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If you are waiting for an overlay memory location to be cleared: 



>*STP;DT;TST=a87()20 



You can use the system reset character to stop the repeat if the specified 
test conditions are never reached. 

The TST register is set to all Is at the start of a repeat. This is necessary so 
that the register is in a known state at the start of a repeat loop. 

Repeats can also be terminated by the states of the limit (LIM) and index 
(IDX) registers. Just before execution begins, the values of LIM and IDX 
are compared. If IDX is greater than or equal to LIM, the repeat is 
terminated. The LIM register is initialized to the number of times the loop 
will execute, which is the decimal loop count you specified in the 
command line. 

IDX is a counter. It starts at zero and is incremented every time the repeat 
loop is executed. You may assign new values to these registers within 
repeat command lines if you wish. 

For example, if you need a decimal counter: 



>BAS IDX=#10 
>*#3 IDX 
#0 

#1 

#3 
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Initialize a block of memory to a decrementing count ending in zero, then 
display it. 



>BYM; M $1000 


$001000 $34 


>*4 LIM-IDX-1 


$001001 $C0 




$001002 $BF 




$001003 $00 




$001004 $21 


>M MMP-4 


$001000 $03 


>*4 


$001001 $02 




$001002 $01 




$001003 $00 




$001004 $21 


> 
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REPEAT COMMAND LINE 



Command Result 



/ Re-executes the previous 

command line. No IreturnI is 
necessary. 



Comments 



In order to be recognized as the repeat character, the slash must be the first 
character on a line. 



Examples 



This causes the system to single step and disassemble the instruction just 
executed. 



>STP;DT 

>/ 
>/ 
>/ 
>/ 



This causes the system to single step and disassemble memory starting at 
the instruction pointer (IP) location. 



>STP;DIS CS:IP LEN 10 
>/ 
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Symbols 

Symbol definitions allow you to refer to addresses and data values using 
names rather than numbers. Symbols are 32-bit integer values and sections 
are 32-bit ranges. Symbols and sections are sometimes collectively 
referred to as symbols. 

64K bytes of overlay memory are allocated for symbol definitions. To 
determine approximately how many symbols you can define, take the 
average symbol name length, add six and divide into 64K (64 x 1024). 

Symbols are not typed within the Emulator, so all symbols are global. This 
implies that a symbol and a section may not be defined using the same 
name. A symbol name may only be defined once. Section range values 
may not overlap. 

Symbols may be redefined by assigning a new value to the symbol name. If 
you want to reassign a symbol name to a section value, or if you want to 
change the range value of a section, you need to delete the symbol or 
section name before assigning the new value. 

Most compilers and assemblers create symbol tables from the symbols 
defined in the program. These symbols can be easily downloaded if you 
have a linker and converter that can create Extended Tekhex serial data 
records. See the SET command (page 5-3) for the serial data format 
variable. If you are going to download sections that have already been 
defined (perhaps from a previous download of the same file), purge all 
symbols or delete the section definitions from memory before 
downloading. If you do not, an error occurs when you attempt to redefine 
the value of a section, and the download aborts. 

Symbols may be used as parameters to any ESL commands. The only 
limitation on symbols is that they cannot be used meaningfully with the 
colon operator (0). The single line assembler accepts symbols as address 
references and data values. 

Memory and trace disassembly display symbol names in place of absolute 
values for address fields. The following examples illustrate the difference 
when the same program is disassembled with and without symbol 
definitions. 
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Examples 



First, the symbols are defined. 



>SYM 
$00000480 csr 
$00000486 sh_csr 
$00001000 CMND 
$00001022 Tauc 
$00000004 busy 
$00000002 got_it 
$00000080 action 
$00004020 es10 

>SEC 
$000010000 TO $00001 04F monitor 



The following example shows memory disassembly with symbol 
definitions. 



>GR0 


=1000 LEN 2A 






>DIS 


GR0 






CMND 








1000 


F70680048000 


TEST 


WORD PTR csr, 0080 


1006 


74F8 


JE 


SHORT CMND 


1008 


C606800402 


MOV 


BYTE PTR csr, 02 


100D 


C606860402 


MOV 


BYTE PTR sh csr, 02 


1012 


A02040 


MOV 


AL, BYTE PTR es10 


1015 


800E860404 


OR 


BYTE PTR sh csr, 04 


101A 


8A268604 


MOV 


AH, BYTE PTR sh csr 


101E 


88268004 


MOV 


BYTE PTR csr, AH 


Tauc 








1022 


F70680048000 


TEST 


WORD PTR csr, 0080 


1028 


75 F8 


JNE 


SHORT Tauc 
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The following example shows trace disassembly with symbol definitions. 



>DTB 








>PARTIAL 


T.M. MAP: PASS 1 


PASS 2 


FULL T.M. 


MAP: PASS 1 


PASS 


2 


SEQ# ADDR 


OPCODE MNEMONIC 


OPERAND FIELDS BUS CYCLE DATA 


SEC: mom" tor 






0038+CMND 








0038+0000 


F7068004800 


TEST 


WORD PTR csr,0080 


0034+0006 


74 F8 


JE 


SHORT CMND 


0033+0008 


C606800402 


MOV 


BYTE PTR csr,02 


0031+000D 


C606860402 


MOV 


BYTE PTR sh_csr,02 


0027+0012 


A02040 


MOV 


AL.BYTE PTR es10 


0026+0015 


800E860404 


OR 


BYTE PTR sh_csr f 04 


0021+001A 


8A268604 


MOV 


AH, BYTE PTR sh_csr 


0018+001E 


88268004 


MOV 


BYTE PTR csr,AH 


0014+Tauc 








0014+0022 


F70680048000 


TEST 


WORD PTR csr,0080 


0010+0028 


75 F8 


JNE 


SHORT Tauc 


0008+002A 


EBD4 


JMP 


SHORT CMND 


0005+CMND 








0005+0000 


F706 


TEST 


WORD PTR 0000,0617 
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The following example shows trace disassembly without section 
definitions. 



>DEL 'monitor 






FULL T.M. 


MAP: PASS 1 


PASS 


2 


SEQ# ADDR 


OPCODE MNEMONIC 


OPERAND FIELDS BUS CYCLE DATA 


0038 CMND 








0038 1000 


F7068004800 


TEST 


WORD PTR csr f 0080 


0034 1006 


74 F8 


JE 


SHORT CMND 


0033 1008 


C606800402 


MOV 


BYTE PTR csr f 02 


0031 100D 


C606860402 


MOV 


BYTE PTR sh_csr,02 


0027 1012 


A02040 


MOV 


AL,BYTE PTR es10 


0026 1015 


800E860404 


OR 


BYTE PTR sh_csr,04 


0021 101A 


8A268604 


MOV 


AH, BYTE PTR sh_csr 


0018 101E 


88268004 


MOV 


BYTE PTR CSr,AH 


0014 Tauc 








0014 1022 


F70680048000 


TEST 


WORD PTR csr,0080 


0010 1028 


75 F8 


JNE 


SHORT Tauc 


0008 102A 


EBD4 


JMP 


SHORT CMND 


0005 CMND 








0005 1000 


F706 


TEST 


WORD PTR 0000, 06F7 
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The following example shows a memory disassembly with both sections 
and symbols purged, followed by a trace disassembly with no section or 
symbol definitions. 



>PUR 








>SYM;SEC 








> 

>DIS GRO 








1000 F70680048000 TEST 


WORD PTR 0480,0080 




1006 74 F8 


JE 


SHORT 1000 




1008 C606800402 MOV 


BYTE PTR 0480,02 




100D C606860402 MOV 


BYTE PTR 0486,02 




1012 A02040 MOV 


AL,BYTE PTR 4020 




1015 800E860404 OR 


BYTE PTR 0486,04 




101 A 8A268604 MOV 


AH, BYTE PTR 0486 




101E 88268004 MOV 


BYTE PTR 0480, AH 




1022 F70680048000 TEST 


WORD PTR 0480,0080 




1028 75 F8 
> 
>DTB 


JNE 


SHORT 1022 










FULL T.M. 


MAP: PASS 1 


PASS 2 




SEQ# ADDR 


OPCODE MNEMONIC OPERAND FIELDS BUS CYCLE 


DATA 


0038 1000 


F7068004800 


TEST WORD PTR 0480,0080 




0034 1006 


74 F8 


JE SHORT CMND 




0033 1008 


C606800402 


MOV BYTE PTR 0480,02 




0031 100D 


C606860402 


MOV BYTE PTR 0486,02 




0027 1012 


A02040 


MOV AL,BYTE PTR 4020 




0026 1015 


800E860404 


OR BYTE PTR 0486,04 




0021 101A 


8A268604 


MOV AH, BYTE PTR 0486 




0018 101E 


88268004 


MOV BYTE PTR 0480, AH 




0014 1022 


F70680048000 


TEST WORD PTR 0480,0080 




0010 1028 


75 F8 


JNE SHORT 1022 




0008 102A 


EBD4 


JMP SHORT 1000 




0005 1000 


F706 


TEST WORD PTR 0000, 06F7 
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DISPLAY SYMBOLS 



Command Result 



SYM Displays all defined symbols. 

SYM <value> Displays all symbols assigned 

the specified value. 

><symbol> Displays the value of the 

specified symbol. 



Examples 



>'sym = 


1000 




>'start 


= 8000 




>'end = 


■start 


+37E 


>SYM 






$00001000 


sym 




$00008000 


start 




$0000837E 


end 
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DISPLAY SECTION 



Command 



Result 



SEC 



Displays all currently defined 
sections and their values. 



SEC < value > 



Displays the section assigned the 
specified value. 



, <section> 



Displays the value of the 
specified section. 



Examples 



>'sec = 1000 


LEN IF 




>■ init mod = 


■start TC 


) 'end 


>'RAM =$0000 


TO $FFFF 




>SEC 






$00001000 TO 


$0000101 F 


sec 


$00008000 TO $0000837E 


init mod 


$00000000 TO 


$0000FFFF 


RAM 
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SYMBOL DEFINITION 



Command Result 



'<symbol> = <value> Assigns the <value> to the 

specified symbol. 



Comments 



A space indicates the end of the symbol name. Symbol names can be up to 
64 characters long, but only 16 character names can be uploaded and 
downloaded. 

<symbol> Any combination of ASCII characters with decimal 
values in the range 33-126. This range includes all 
of the printable ASCII characters. 

<value> A 32-bit integer value or a range. 

Be sure to end a symbol name with a space when assigning a value. If a 
space is not entered as the last character of a symbol name, the characters 
that follow are recognized as a continuation of the symbol. 

Once you type the single quote, the Emulator displays what you type in 
lower case letters unless you explicitly type upper case letters (using the 
shift key). After a space is typed (ending the symbol name), display 
reverts to all upper case letters. 

If a symbol name is assigned a value that is a range, it is assumed that you 
are defining a section. Section range values cannot overlap. 
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SYMBOL DEFINITION (cont.) 



Examples 



■testingl is recognized as the symbol. 



>' testing =GR0 



testing=GROl is recognized as the symbol name. The name will probably not 



be found and you will get an error message. 



>'testing=GRO 




>'section_X =10000 TO 1FFF 
>'main_loop ='prog_start TO 


■RAM_START-1 
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DELETE A SYMBOL OR SECTION 



Command 



Result 



DEL i <symbol> 
DEL i <section> 

Examples 



Deletes the specified symbol. 



Deletes the specified section. 



>SYM 




$00001000 


Sym 


$00008000 


start 


>DEL 'Sym; SYM 


$00008000 


start 


> 
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DELETE ALL SYMBOLS AND SECTIONS 



Command Result 



PUR Purges all symbols and section 

references. 



Comments 



Be sure to purge before downloading symbols that may already be defined. 
If you do not, an error occurs and the download is aborted. 



>SYM 






$00001000 


sym 




$00008000 


start 




$0000837E 


end 




>SEC 






$00001000 


TO $0000101 F 


sec 


$00008000 


TO $0000837E 


init mod 


$00000000 


TO $0000FFFF 


RAM 


>PUR;SYM, 


■SEC 




> 
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Miscellaneous Commands 
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DISPLAY THE SOFTWARE REVISION DATES 



Command Result 



REV Displays the software revision 

dates for ESL, firmware, and 
disassembler. See page 3- 15. 



Comments 



This command is valid only in pause mode. 

When you call AMC customer service, they will ask you what software 
revisions are in your machine. This command gives you the necessary 
information. 



Examples 



>REV 




WED AUG 6 


08:50:26 PDT 1986 - ESL 1.0 


WED AUG 6 


16:50:26 PDT 1986 - FW 1.0 


TUES DEC 1 


12:20:32 PDT 1986 - DIS 1.0 


> 
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DISPLAY A BLANK LINE 



Commaind Result 



RET Executes a [return 1 , linefeed 



Comments 



This command improves readability when displaying multiple lines of 
data. 



Examples 



Display two blocks of data, separating them with a blank line. 



>DB SS 


:SP LEN 20;RET;DB DS:DX LEN 20 


07FF76 


02 06 • 20 46 40 62 00 00 12 20 .. Fab... 


07FF80 


07 90 90 00 70 20 03 07 - 47 41 63 01 01 21 21 71 p ..GAc.Mq 


07FF90 


01 90 06 21 12 13 ...!.. 


088060 


01 02 03 04 05 06 07 08 - 00 20 21 22 23 24 25 26 !"#$%& 


088070 


30 31 32 33 34 35 36 37 - 55 56 50 49 48 47 30 30 01234567UVPIH600 
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TARGET COMMANDS 



Introduction 

The term "run mode" indicates that emulation has begun, that the 
microprocessor in the pod is running a program in the target. Pause mode 
is the opposite of run mode. The term "pause mode" indicates that 
emulation is not taking place. Generally, the target is the hardware and 
software that you are debugging. If there is no target hardware available, 
the target may be just a program, downloaded into the overlay memory. 
The microprocessor in the Emulator's pod replaces the microprocessor in 
the target. This gives the Emulator control of the processor, which in turn 
gives you use of the powerful Event Monitor System and the ability to see 
what is happening within the target system. 

The processor in the pod runs the target in real-time. All processor 
functions are available and valid during emulation. 
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Virtual Operations 

In real mode, the 80286 behaves like an 8086, except that fewer clock 
cycles are required for most instructions. Only 20 of the 24 address lines 
are used, and the 20 bit addresses are generated by shifting the 16 bit 
segment register left four places and adding the 16 bit offset. 

In virtual protected mode, the segment register becomes a pointer to an 
entry in a descriptor table in memory. A descriptor table is a place in 
memory that stores the present physical location of each block of virtual 
memory, as well as protection information for that memory block. 

Figure 7 . Virtual Operations 



CPU 



80288 



V 



LOGICAL ADDRESS 







MMU 



0000 0000 



PHYSICAL ADDRESS 



V 




FrFF FFFF 



MEMORY 



A DESCRIPTOR TABLE ENTRY 



UNUSED 


ACCESS 


LIMITS 


LIMITS 


BASE 


BASE ADDRESS 



PHYS CAL ADDRESS = BASE ADDRESS + OFFSET 



The 80286 descriptor table contains a 24 bit physical segment address, 
which the on-chip memory management unit adds to the offset to generate 
the physical address. Since all 24 lines are used, 16 megabytes are 
accessible, as opposed to 1 megabyte when emulating the 8086. 
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Another feature of virtual operations is the existence of privilege levels, 
crucial for multiuser systems. Four privilege levels are possible, and the 
descriptor table entry notes which level may access each region of memory. 
This prevents users on a time -shared system from interfering with the 
executive program or other users' programs or data. It also means that the 
logical (virtual) addresses that the program thinks it is using are internal to 
the CPU chip and do not appear on the address bus. 

These features make hardware debugging of the 80286 more complex than 
it is for other chips. The ESI 800 Emulator supports the following features 
which aid in making debugging the 80286 possible: 

■ Showing logical and physical addresses in disassembly 
display 

■ Accessing all protected-mode registers 

■ Examining and modifying the descriptor table 

■ Assembling patches in protected mode 

■ Setting breakpoints on either logical or physical addresses 

■ Setting breakpoints on descriptor table changes (optional) 

■ Mapping on logical addresses 

ADDRESS MODES 

When programming a chip like the 80286, you use logical rather than 
physical addresses, but logical addresses are not available outside the chip. 
The translation from logical to physical takes many steps without an 
Emulator. It becomes still harder if the memory map changes after 
loading. 

These physical-to-logical mappings are not necessarily one to one, so their 
translation must provide a table of all descriptors that would lead to the 
physical address. The ESI 800 displays an error message if protection 
violation occurs in going from the logical to the physical. The ESI 800 
allows breakpoints to be set in one or a range of logical addresses and 
allows you to set a flag to make addresses of the form, |nnnnH:nnnnH] be taken 
systemwide as either logical or physical. 
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Two commands are used to globally designate the mode (physical or 
virtual) in which addresses are entered and displayed. 

PHY Physical address mode. When the Emulator is in 

physical mode, a pair of 16 bit values separated by a 
is interpreted and viewed as a segmented address with 
an offset. All addresses displayed by the Emulator are 
absolute values (no operator), except the CS and IP in 
the register display. The segment value is rotated to the 
left four places and then added to the offset value prior 
to being displayed. 



>PHY 

>0F000:0001 
S000F0001 

> 

>VIR 

>0F000:0001 
$F000:0001 

> 



VIR 



Virtual address mode. When the Emulator is in virtual 
mode, a pair of 16 bit values separated by a (T) is 
interpreted and viewed as a selector value with an 
offset. 



>PHY 

>0F000:0001 
$000F0001 

> 

>VIR 

>0F000:0001 
$F000:0001 
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Processor and Emulator Mode Translation 

The Emulator's physical and virtual modes interact with the processor's 
real and protected modes. Real and protected modes are determined by the 
PE bit in the CPU's MSW register (refer to the Intel iAPX286 Hardware 
Reference Manual and the Intel iAPX286 Programmer's Reference Manual 
for information on the PE and MSW registers). The following chart will 
help determine which registers are available and how addresses are 
displayed, depending on the combinations of modes used. 

Processor and Emulator Mode Translation 



PROCESSOR--) 
EMULATOR f 



REAL 



PROTECTED 



PHYSICAL Absolute addresses used. 
8086 attribute used. No 
No "DRL" emulator command 
available. No modification 
or viewing of hidden MMU 
registers available. 



Absolute addresses used. 
"DRL" available. Hidden 
MMU registers available 
for viewing. Protections 
of processor not enforced. 



VIRTUAL Virtual addresses used. 

All other 8086 attributes 
used. No "DRL" available. 
No modification or viewing 
of hidden MMU registers 
except LDTR and GDTR. 



Virtual addresses used. 
"DRL" available. Modifi- 
cation and viewing of hid- 
den MMU registers avail- 
able. 
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USING THE DESCRIPTOR TABLES 

The overlay memory function also works with descriptor tables, which are 
in memory. The ESI 800 includes an assembler and disassembler for the 
descriptor table, allowing you to create a new table or look at an old one, 
thus speeding up the debug process. You may break emulation on access to 
any descriptor table entry and use descriptor table tools to write new values 
to the table. Then, by switching back to run mode, you can continue 
emulation with the new table contents. 
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CPU AND EMULATOR STATE TRANSITION 

The diagram describes the methods for moving from one state to another. 
A state is a combination of modes used by the Emulator and processor and 
is displayed via the DMD command. The Emulator controls the physical 
(PHY) and the virtual (VIR) modes. The processor is in control of the 
protected and real modes. The numbers refer to the action the Emulator or 
CPU must perform to change to a different state. 

On power-on reset, the Emulator state tracks the state of the processor on a 
run-to-pause transition. This is referred to as "tracking." 

When the virtual (VIR) or physical (PHY) command is issued and a run- 
to-pause transition occurs, the Emulator maintains the user- selected state 
(VIR or PHY) regardless of the processor state, indicating the Emulator is 
no longer tracking. Tracking can then be re-enabled by issuing the TRK 
command. 

Figure 8. CPU and Emulator State Transitions 




Note: Unless otherwise specified, all transitions are based on "Not Tracking" 
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The numbers below explain the functions on the chart. 

1. Cause a reset from the target hardware or issue an RST 
command from the Emulator keyboard while paused (not 
running). 

2. Cause a reset from the target hardware or issue a RST 
command from the Emulator keyboard while running. 

3. Set PE bit in MSW. 

4. Clear the PE bit in the MSW. 

5. Issue a PHY command on the Emulator (this clears 
tracking). 

6. Issue a VIR command on the Emulator (this clears 
tracking). 

7. Enter emulation (run or single step), then stop emulation 
while processor is in real mode. 

8. Enter emulation (run or single step), then stop emulation 
while processor is in protected mode. 

9. Execute code in the target that will put the processor into 
protected mode. 

10. Run-to-pause transition (break on a STP command) 
while tracking is ON. 

1 1 . Issue a TRK command while in pause mode. 
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USING REGISTERS IN VIRTUAL MODE 

The selector points to an area in memory that determines the actual 
address. That area in memory is called the descriptor table. The descriptor 
table entry has base, limit, and access information. The descriptor table 
assembler (ADT) and descriptor table disassembler (DDT) allow you to 
hand write a descriptor table. 



>DRL 


















IT 


AX 


BX 


CX 


DX SI 


DI 


BP 


SP 




FFFO 


0000 0000 


0000 


0000 0000 0000 


0000 


0000 




FLX = 






iop = n 


MSW = 


ACCESS 




REG 


INDEX 


TI 


RPL 


BASE 


LIMIT 


DPL 


CS 


1E00 


G 





FF0000 


FFFF 


PCD 


U W 





DS 


0000 


G 





000000 


FFFF 


PCD 


U W 





ES 


0000 


G 





000000 


FFFF 


PCD 


U W 





SS 


0000 


G 





000000 


FFFF 


PCD 


U W 





GDTR 
LDTR 


0000 


G 





000000 
000000 


0000 
0000 






. 


. C D 


U . 


IDTR 
TR 


0000 


■ 

G 





000000 
000000 


FFFF 
0000 









. C D 


U . 



VIRTUAL OPERATIONS COMMANDS 

The following six commands convert a physical address to a virtual address 
and vice versa, switch to physical or virtual mode, and assemble and 
disassemble the descriptor table. 
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PHYSICAL TO VIRTUAL 



Command 



Result 



PTV <expression> 



Converts a physical address to a 
virtual address. 

The <expression> is any address 
that evaluates to an unsigned 
binary value between and 
2 24 -l. The Emulator scans the 
descriptor tables in the target 
system to find the logical 
address record(s) that 
corresponds to the physical 
expression. 

The logical address is displayed 
in the format: <selector> 
:<offset>. If multiple mappings 
are possible, they are all listed. 

Valid descriptor tables must 
exist in the target memory for 
this command to produce 
accurate results. 
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VIRTUAL TO PHYSICAL 



Command 



Result 



VTP < selector >:<offset> 



Converts a virtual address to a 
physical address. 

The selector entry is found in 
the target system's descriptor 
tables; the physical address is 
calculated and displayed as an 
unsigned 24 bit value. 

If no entry is found, the error 
message, DESCRIPTOR 
TABLE INVALID, is displayed. 
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PHYSICAL ADDRESS MODE 



Command 



Result 



PHY 



When the Emulator is in 
physical mode, two 16 bit values 
separated by a [7] is interpreted 
and viewed as a segmented 
address with an offset. All 
addresses disp^red by the 
Emulator are absolute values 
(no Q] operator), except the CS 
and IP in the register display. 
The segment value is rotated to 
the left four places and then 
added to the offset value prior 
to being displayed. 



>PHY 

>C)F000:0001 
$000F0001 

> 

>VIR 

>C)F000:0001 
$FC)00:0001 

> 
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ASSEMBLE DESCRIPTOR TABLE 



Command 



Result 



ADT <argument> 



Assembles a descriptor table 
entry and prompts the user for 
allowable inputs. As it is 
assembled, the table is expanded 
and displayed in DDT format. 



Quits current line and assembles 
previous line. 

Quits current line and assembles 
next line. 



RETURN 



Enters current line. 



XorQ 



Exits the ADT command at any 
time. 



Comments 



The ADT command may take one or two arguments or be used alone. In 
real mode with no arguments, it assembles a descriptor table starting at or 
at the last entry to be assembled from a previous exit from ADT. ADT 
interprets a single argument as the table base, and assembly begins at this 
point in physical memory. With two arguments, ADT interprets the first as 
the table base and the second as the selector number (lower three bits are 
masked off). In real mode, ADT always assigns a limit of $FFFF. 
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ASSEMBLE DESCRIPTOR TABLE (cont.) 



In protected mode with no arguments, ADT obtains the base and limit from 
GDTR the first time it is entered. On subsequent usage, ADT continues 
with the same base, limit, and selector that were in effect on previous exit. 
If the base of the table is modified or if the limit is set to a value less than 
the previous exit value, ADT interprets the first as a selector for the global 
descriptor table and the second as a selector for a local table. Assembly 
begins in the local table at the specified selector. An LDT descriptor must 
be present in the global table at the selector specified by the first 
argument. 

When using ADT in real mode after using it in protected mode, if no 
arguments are specified it uses the base, limit, and selector in effect when 
exiting ADT in protected mode. 



Examples 



The following is an example of an ADT operation in protected mode. 



>ADT 


500 






GLOBAL 


DESCRIPTOR TABLE: BASE = $00200C 


LIMIT = $0FFF 


$0500 


- . ..> P 




P=PRESENT, <RET>=MOT PRESENT 


$0500 


- PRS/ ...> S 




S=SEGMENT, C=CONTROL 


$0500 


- PRS/SEG/ ...> C 




D=DATA, C=CODE 


$0500 


- PRS/SEG/COD ...> R 




X=EXEC ONLY, R=EXEC/READ 


$0500 


- PRS/SEG/COD/XR/ ...> C 




C=C0NF0RMING, <RET>=NOT CONF 


$0500 


- PRS/SEG/COD /XR/CNF ...> A 




A=ACCESSED, <RET>==NOT ACCESSED 


$0500 


- DPL > 3 




DES PRIVILEGE LEVEL (0-3) 


$0500 


- DPL=3 BASE > 500000 




BASE (0 TO $FFFFFF) <RET> 


$0500 


- DPL=3 BASE = $500000 LIMIT > 


0FFFF 


LIMIT (0 TO $FFFF) <RET> 


$0500 


- DPL=3 BASE = $500000 LIMIT = 


$0FFFF<RET> = ENTER DESCRIPTOR 


$0500 


- PRS/SEG/COD/XR/CNF/ACC DPL 


= 3 


BASE = 50000 LIMIT = FFFF 


$0508 
> 


- ...>X 




P=PRESENT, <RET>=MOT PRESENT 
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DISASSEMBLE DESCRIPTOR TABLE 



Command 



Result 



DDT <argument> 



Disassembles a descriptor table. 



Also displays a jdpt = | prompt 
accepting one of the following 
responses: 



H 



Displays on-line help. 



Goes up one entry. 



, Or [RETURN 

Space or D 



Goes down one entry. 

Displays down one page in 
table. 



U 



Displays up one page in table. 
Mainly useful after Space or D. 



XorQ 



Exits the DDT command at any 
time. 



<n> Goes to specified selector. 

DDT may take one or two arguments or be used alone. In real mode with 
no arguments, it disassembles a descriptor table starting at memory address 
0, or at the last entry to be disassembled from a previous exit from DDT. 
DDT interprets a single argument as the table base. Assembly begins at 
this point in physical memory. With two arguments, DDT interprets the 
first as the table base, and the second as the selector number (lower three 
bits are masked off). In real mode, DDT always assigns a limit of $FFFF. 
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DISASSEMBLE DESCRIPTOR TABLE (cont.) 



In protected mode with no arguments, DDT obtains the base from the 
GDTR the first time it is entered. On subsequent usage, DDT continues 
with the same base, limit, and selector that were in effect on previous exit. 
If the base of the table is modified or if the limit is set to a value less than 
the previous exit value, DDT uses the new base and limit, and starts up at 
selector 0. It interprets a single argument as a selector. With two 
arguments, DDT interprets the first as a selector for the global descriptor 
table and the second as a selector for a local table. Disassembly begins in 
the local table at the specified selector. An LDT descriptor must be 
present in the global table at the selector specified in the first argument. 
When using DDT in real mode after using it in protected mode, if no 
arguments are specified, it uses the base, limit, and selector in effect when 
exiting DDT in protected mode. 

The following is an example of a DDT operation. 



>DDT 




















GLOBAL 


DESCRIPTOR TABLE: BASE = 


$002000 


LIMIT 


r = $008F 








$0000 ■ 


PRS/SEG/DAT/RW/EDU/ACC 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


$FFFF 


$0008 ■ 


PRS/SEG/DAT/RO/EDN/. . . 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


SFFFF 


$0010 ■ 


PRS/SEG/DAT/RO/EUP/. . . 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


$FFFF 


$0018 


PRS/SEG/COD/XO/CN F/ACC 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


SFFFF 


$0020 


■ PRS/SEG/COD/XR/.../... 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


SFFFF 


$0028 


■ PRS/SEG/COD/RW/CNF/... 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


SFFFF 


$0030 


■ PRS/SEG/COD/RD/.../ACC 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


SFFFF 


$0038 


■ PRS/SEG/COD/RD/CNF/ACC 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


$FFFF 


$0040 


■ PRS/CTL/TSS BUSY 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


SFFFF 


$0048 


■ PRS/CTL/TSS AVAILABLE 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


$FFFF 


$0050 


■ PRS/CTL/LDT DESCRIPTOR 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


SFFFF 


$0058 


■ PRS/CTL/RESERVED 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


SFFFF 


$0060 


• PRS/CTL/INVALID 


DPL 


= 


3 


BASE 


= $500000 


LIMIT 


= 


SFFFF 


$0068 


■ PRS/CTL/TASK GATE 


DPL 


= 


3 


DST $5000:0000 








$0070 


- PRS/CTL/CALL GATE 


DPL 


= 


3 


DST $5000:0000 


WRDCT 


= 


$001 F 


$0078 


■ PRS/CTL/CALL GATE 


DPL 


= 


3 


DST $5000:0000 


WRDCT 


= 


$0000 


$0080 


■ PRS/CTL/INTR GATE 


DPL 


= 


3 


DST $5000:0000 








$0088 


■ PRS/CTL/TRAP GATE 


DPL 


= 


3 


DST $5000:0000 








END OF 


DESCRIPTOR TABLE 


















DDT: 
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VIRTUAL ADDRESS MODE 



Command 



Result 



VIR 



When the Emulator is in virtual 
mode, two 16 bit values 
separated by a are interpreted 
and viewed as a selector value 
with an offset. 



>PHY 

>0F000:0001 
S0OOF0001 

> 

>VIR 

>0F000:0001 
$F000:0001 

> 
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Emulation 

STARTING EMULATION 

Enter run mode by executing any of four run commands. Two of the run 
commands load the reset vectors before entering run mode, and two of 
them enable the breakpoints in the Event Monitor System. Event system 
breakpoints may be enabled or disabled during run mode. Even when 
breakpoints are disabled, all other Event Monitor System functions are 
active. The reset vectors are defined by Intel as: 



cs 


= 


F000 


IP 


= 


FFFO 


FLX 


= 


0002 



The reset vectors cannot be loaded during run mode. RUN and RBK are 
typically used in run mode to disable and enable break points. The 
following table is a quick reference to the RUN commands. 





Load 


Break- 




Run 


Reset 


points 


Valid in 


Command 


Vectors 


enabled 


Run mode 


RUN 


NO 


NO 


YES 


RNV 


YES 


NO 


NO 


RBK 


NO 


YES 


YES 


RBV 


YES 


YES 


NO 



Many Emulator commands are valid during run mode. If you are unsure 
whether a command may be entered during run mode, just enter it. An 
error message is displayed if it is not valid. Some commands need to 
communicate with the pod processor, and many of these commands cannot 
be entered during run mode, because emulation must stop in order to 
complete the command. 
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The following commands may be entered in run mode, but do halt 
emulation briefly in order to read or write data to the target system or 
overlay memory. 



M 


- Memory mode 


MIO 


- I/O mode 


a 


- Indirection operator 


DB 


- Display block of memory 


ASM 


- In-line assembler 


DIS 


- Memory disassembler 


NXT 


- Memory mode 


LST 


■ Memory mode 



If there are target hardware problems, it may not be possible to enter run 
mode. In these cases, error messages are displayed describing the problem. 
If the error conditions do not clear, a reset may be required to bring the 
system back into command entry mode. 

HALTING EMULATION 

Emulation can be halted in one of four ways: 

1. Enter the stop emulation command, STP. When this 
command is entered during run mode, emulation is 
stopped and the values of the microprocessor registers are 
copied into Emulator memory. The current CS:IP and 
event monitor group number are displayed. 

2. The Event Monitor System can stop emulation if you 
have set up breakpoints and the breakpoints are enabled. 
When a breakpoint condition occurs, emulation is halted, 
the microprocessor registers are copied into Emulator 
memory, and the CS.IP and event monitor group number 
are displayed. 
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3. Issuing the reset character stops emulation. (See page 
4-29 for information on the reset character.) After the 
reset character is issued, the Emulator registers have the 
same value they had before emulation began. The 
operator should check those values or load the reset 
vectors (LDV) before restarting emulation. 

4. Emulation breaks automatically if the target program 
commits an access or write violation in overlay memory. 
(See page 5-67 for overlay memory access rights). An 
error message indicates the condition that caused the 
error. 

USING REGISTERS IN RUN MODE 

Setting and displaying the microprocessor registers during run mode can 
lead to unexpected results because the Emulator keeps a RAM image of the 
microprocessor registers. This image is copied to the processor whenever 
run mode is entered. The image is copied from the processor when 
emulation is stopped by the STP command or the Event Monitor System. 

Because of this, modifying these registers during run mode simply alters 
the Emulator's image of the registers. The Emulator does not copy the new 
values of the registers to the microprocessor. When emulation is broken, 
the current values of the microprocessor registers are copied and the RAM 
image is overwritten. Thus, you cannot dynamically change the value of 
the microprocessor registers while emulating, and a display register 
command entered after emulation has begun v/ill show you the register 
values upon entry to emulation, not the values the registers currently 
contain. 



6-20 



RUN TARGET PROGRAM 



Command 



Result 



RBK 



Begins executing the target 
program at the current CS.IP 
memory location with 
breakpoints enabled. 



RBV 



Loads the restart vectors and 
begins executing the target 
program at memory location 
FFFFFOH with breakpoints 
enabled. 



RUN 



Begins executing the target 
program at the current CS:IP 
memory location with 
breakpoints disabled. 



RNV 



Loads the restart vectors and 
begins executing the target 
program at memory location 
FFFFFOH with breakpoints 
disabled. 
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RUN TARGET PROGRAM (cont.) 



Comments 



Refer to Chapter 7, Event Monitor System, for breakpoint information. 

RNV and RBV are valid only in pause mode. 

All defined events are active while RBK and RBV are executing. 

Run commands containing a B indicate that Event System breakpoints are 
enabled. Run commands containing a V indicate that the reset vectors are 
loaded prior to entering run mode. 

Entering RNV is identical to entering LDV;RUN and entering RBV is the 
same as entering LDV;RBK. 
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STOP AND STEP TARGET SYSTEM 



Command 



Result 



R>STP 



>STP 



From run mode the STP 
command stops emulation and 
returns the Emulator to pause 
mode. 

Displays the current CS:IP 
address and the Event Monitor 
System group number. 

From pause mode, the STP 
command executes one 
instruction. To receive visual 
feedback, combine this 
command with a display 
command such as STP;DT. 



Comments 



R>\ indicates that the Emulator is in run mode. [>] indicates that the 



Emulator is in pause mode. 

See the Switch section under STI, page 5-33 for more information about 
stepping. 
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STOP AND STEP TARGET SYSTEM (cont.) 



Examples 



>STP;DR 
>STP;DT 
>STP;DIS IP LEN 4 
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LOAD RESET VECTORS 



Command Result 



LDV Loads the CPU reset vectors. 



Comments 



This command is valid in pause mode only. 

RNV and RBV also load the reset vectors, then enter run mode. The RST 
command resets the processor if in run mode and always loads the reset 
vectors. 

Intel defines the CPU reset vectors as: 



cs = F000 
IP = FFFO 
FLX = 0002 



To verify that the reset vectors are loaded, execute the DR command or 
individually display the CS, IP and FLX registers. 

Refer also to Registers (page 5-74). 
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LOAD RESET VECTORS (cont.) 



Examples 



Display the registers, then load the reset vectors, clear the data registers, 
and verify the changes by redisplaying the register set. 



>DR 
























CS:IP FLX 


AX 


BX 


CX 


DX 


DS 


S)[ 


ES 


DI 


BP 


ss 


SP 


8000:1002 Z.. 


. 0100 


FF00 


1234 


0040 


cooo 


0000 


D000 


0000 


0000 


ccoo 


0024 


>LDV;CLR;DR 
























CS:IP FLX 


AX 


BX 


CX 


DX 


DS 


SI 


ES 


DI 


BP 


ss 


SP 


F000:FFF0 


0000 


0000 


0000 


0000 


COOO 


0000 


D000 


0000 


0000 


ccoo 


0024 


> 
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WAIT UNTIL EMULATION BREAK 



Command Result 



WAI Delays executing the specified 

command until emulation is 
broken. 



Comments 



Usually this command is used to delay executing a display command until 
an event system breakpoint is reached. 

An event may never occur to bring the Emulator out of run mode. When 
this happens, use the system reset character to reset the system. (See pages 
4- 29, 6-29 for moire information on the reset character.) 

After a reset, the delayed command is lost from the input buffer. 



Examples 



The Emulator disassembles a page of trace after a breakpoint is reached. 
Entering RBK;DTB, without the WAI command, results in a CANNOT 
EXECUTE COMMAND WHILE IN RUN MODE error. 



RBK;WAI;DTB 
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WAIT UNTIL EMULATION BREAK (cont.) 



The Emulator runs until an access violation or a write violation is 
encountered, then displays a message pointed at by the BX register. 



RUN;WAI;DIA BX 



6-28 



RESET 



Command Result 



RST Resets pod microprocessor and 

loads the reset vectors. 



IP = $FFF0 
CS = $FFF0 
FLX = $0002 



Comments 



The RST command can be issued from either run or pause mode. When in 
pause mode, the RST command loads the reset vectors (LDV). While in 
run mode the microprocessor's reset pin is momentarily asserted. This 
causes the microprocessor to start fetching instructions from the reset 
vector. RST does not affect the target reset signal; therefore no target 
hardware is reset. This may cause problems when the target program tries 
to interact with unitialized hardware. 

CTRL Z differs from RST in that CTRL Z stops emulation if in run mode. 
Further, CTRL Z does not initialize the emulator registers. CTRL Z resets 
the universal controller board, Emulator board, and pod, whereas RST 
only resets the pod and microprocessor. 
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RESET (cont.) 



Examples 



In the example below, the Emulator is in run mode. The microprocessor is 
reset in the target environment and emulation continues. 



R> RST 
R> 



In the next example, the Emulator is in pause mode. The microprocessor is 
reset and the reset vectors are loaded into the Emulator registers. 
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Memory Commands 

Memory commands allow you to modify and display memory in a number 
of different ways. "Memory" refers to memory in the target system or the 
Emulator's overlay memory. If the overlay memory is mapped (mapped 
memory will have the RW, RO or ILG attributes assigned to it), read and 
write accesses are directed to it. Mapped memory is modified by a 
memory command even if it is mapped as read only. If memory is 
unmapped, (memory with the TGT attribute assigned to it), memory 
command accesses are directed to the target system memory. Mapped and 
unmapped memory may be interleaved in any way you desire. See the 
Overlay Memory section (page 5-62) for details. 

The default data length affects most memory commands. There are two 
data lengths to choose from: byte mode (BYM) and word mode (WDM). 
Commands that accept data parameters truncate the data entered to the 
current default data length. If you enter |fin o len20,23F6| and the default 
data length is byte mode, the find command truncates the data field to 



F|]and searchs the range for that byte. Commands that display data use the 



current data length. 

Some memory commands may be executed during run mode. These 
commands halt emulation for a brief time in order to read from or write to 
memory. 
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The following table shows the target-related commands that can be 
entered in run mode and the commands that are affected by the default 
data length. 





Command 


Legal in 


Uses Default 




Run Mode? 


Data Length? 


DB 


YES 


YES 


FIN 


NO 


YES 


FIL 


NO 


YES 


BMO 


NO 


YES 


VBL 


NO 


YES 


LOV 


NO 


YES 


VFO 


NO 


YES 


ASM 


YES 


N/A 


DIS 


YES 


N/A 


M 


YES 


YES 


MIO 


YES 


YES 


a 


YES 


YES 
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DISPLAY MEMORY BLOCK 



Command 



Result 



DB < address range> 



Reads and displays the specified 
address range. 



DB 



Reads and displays one page of 
memory, starting at the last 
address displayed by any 
previous DB command. On 
power-up, this command 
displays a page of memory from 
address zero. 



DB <address> 



Reads and displays one page of 
memory, starting at the 
specified address. 



Comments 



The page length is defined by the CRT length parameter in the SET menu 
(see page 5-3). When displaying a block of data in byte mode, the ASCII 
representation of each byte is also displayed. 

The DB command provides an easy way to page through memory. Enter 
the DB <address> command to start reading memory at the desired 
address. Follow the display of this page of data with the DB command, 
and type a slash ( ) (page 5-113). This repeats the DB command to 
increment the address and scroll through memory. 
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DISPLAY MEMORY BLOCK (cont.) 



If the display is longer than one page, the XON/XOFF characters can be 
used to start and stop scrolling (page 4-29). 

DB affects real time operation when entered in run mode (see pages 6-18, 
6-19 and 6-31). 



Examples 



Display 20 words pointed to by DS:DX. 



>WDM; DB DS:DX LEN 20 



Display a page of values pointed to by the value on top of the stack (see 
page 4-13 for information on @ operator). 



>DB S)SS:SP 



Display block in byte mode and word mode. 



>BYM 

>DB LEN 20 

000000 80 48 45 4C 4C 4F 80 80 - 2F OF F1 F9 5E 2F F6 F0 .HELLO../. 

000010 OF 03 F0 40 OF 0C F0 40 - 07 06 F0 90 OF 0C D8 00 ...c»...a.. 



>WDM 

>DB LEN 2F 

000000 4880 4C45 4F4C 8080 • 0F2F F9F1 2F5E F0F6 

000010 030F 40F0 0C0F 40F0 - 0607 90F0 0C0F 00D8 

000020 0FFF F9FF 1FFF 7FFF - 3FFF BDFF 1FFF FFFF 
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FIND MEMORY PATTERN 



Command 



Result 



FIN <range>, <data> 



Searches <range> for the data 
pattern. All occurrences of the 
pattern are displayed: 



$<address>=$<data> 
> 



If the pattern is not found 
within the range: 



NOT FOUND 
> 



Comments 



This command is valid in pause mode only. 

Data may be either an integer or don't care value. The find command uses 
the default data length, regardless of the length of the <data>. (See SET 
#26, page 5-7 for default data length in memory commands.) 

Refer also to the "don't care" description (page 4-11). 
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FIND MEMORY PATTERN (cont.) 



Examples 



(Assume word mode.) To find a bit pattern using don't cares, use either of 
the following forms: 



>FIN 1000 TO 2FFF, 60XX 



or 



>FIN 1000 LEN 1000,6000 DC OFF 



(Assume byte mode.) Find the initialization data in the start module 
section. 



>FIN 


■start_ 


module, 


1 inituart 


Find any 


NOPs 


in the 


range. 


>FIN 


100 TO 


1000,90 
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FILL OPERATOR 



Command 



Result 



FIL <range>i<constant> 



Fills <range> with the 
<constant> data pattern. 



Comments 



This command is valid in pause mode only. 

<constant> must be an integer. 

The FIL command uses the default data length, regardless of the length of 
< constant >. (See page 5-3.) 

The FIL command can be verified using the VBL (Verify BLock) 
command (page 6-38). 



Examples 



Fill RAM with zero to initialize data space. 



>FIL 2000 LEN 50„0 



Fill RAM section with initialization data. 



>FIL "ram, 'initdata 



6-37 



VERIFY BLOCK DATA 



Command 



Result 



VBL < address range>, <data> 



Verifies that <address range> 
contains the specified data. 



Comments 



This command is valid only in pause mode. 

The VBL command uses the default data length, regardless of the length of 
<data>. (See page 5-3.) 



Examples 



Verify that a range contains $3F. 



>VBL TO 


2000, 


3F 




$00000004 


• $00, 


NOT 


$3F 


$00000126 


■ $76, 


NOT 


$3F 


> 
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BLOCK MOVE 



Command 



Result 



BMO<range>,<address> 



Moves <range> to the new 
<address>. 



Comments 



This command is valid in pause mode only. 



Examples 



Move a range to a new location in data space. 



>BMO 100 TO 500, 1000 


Move 20 bytes from the stack to the value pointed to by the data register. 


>BMO SS:SP LEN 20, DX 
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VERIFY BLOCK MOVE 



Command 



Result 



VBM<range> ,<address> 



Verifies move of <range> to the 
new <address>. 



Comments 



This command is valid only in pause mode. 

Verifies that a non-overlapping block move was successful. 
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LOAD OVERLAY MEMORY 



Command 



Result 



LOV <range> 



Moves data from the target 
system memory to the Emulator 
overlay memory in the specified 
address range. 



Comments 



The LOV command may not be entered during run mode. 

Refer to the VFO command, page 6-42 to verify the load overlay 
command. 

To load overlay memory from the target memory, a target system must be 
connected to the ESI 800 Emulator and overlay memory installed and 
mapped. 

To load a target memory range into the overlay memory at a different 
address, use the LOV command, then do a block move of the range. 

Refer also to the Overlay Memory section, page 5-62. 



Examples 



>LOV 80000 LEN 7FFF 
>LOV 'BOOT RANGE 
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VERIFY OVERLAY MEMORY 



Command 



Result 



VFO <range> 



Compares <range> in target 
memory to the same range in the 
overlay memory. 

If there are any differences, the 
address and data difference is 
displayed: 



<address> = XX NOT YY 



Comments 



XX is the data present in 
overlay memory. YY is the data 
at that location in the target 
system memory. 



This command is valid only in pause mode. 

Refer also to the Overlay Memory section, page 5-62. 
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VERIFY OVERLAY MEMORY (cont.) 



Examples 



To verify the two overlay loads in the LOV command section: 



>VFO 80000 LEN 7FFF 
>VF0 'BOOT RANGE 
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LINE ASSEMBLER 



Command 



Result 



ASM 



Assembly begins at the last 
address displayed during a 
previous assembly session. At 
power-up the start address is 
zero. 
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>ASM 












**** 


80286 


LINE 


ASSEMBLER 


VX 


.XLA 


**** 


0000 


>X 












> 















ASM <arg> 



Assembly begins 
specified address. 



at the 



>ASM <address> 




**** 80286 LINE ASSEMBLER 


VX.XLA **** 


0000 >END 




> 





END 

X 



Exits line assembly. 



oooo >x 
> 



LINE ASSEMBLER (cont.) 



Comments 



Modification of the line assembler address is a two-step process. 

1. To change the segment, use the CSEG directive after 
entering line assembly mode. 

2. To change the offset, enter the assembler using a 16-bit 
address parameter, or use the ORG directive after 
entering the assembler. 

All 80286 instructions can be entered from line assembly mode. The 
instructions are converted to machine code and loaded into memory at the 
address specified in the prompt. 

The following pages describe the supported assembler directives. 
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ASSEMBLER DIRECTIVES 



Command 



Result 



CSEG 



Sets 64K byte code segment 
window: 
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1012 >CSEG D400H 
1012 > 



ORG 



Sets 64K byte offset into the 
code segment window: 



1012 >ORG 3ACH 
03AC > 



END or X 



Exits line assembler to the 
command level: 



58FD >x 
> 



ASSEMBLER DIRECTIVES (cont.) 



DB 



Defines constant byte data: 



58FD 


>DB 


1 


,2,: 


5,4, 


"TEST", 







58FD 


01 


02 


03 


04 


54 45 53 


54 


00 


5907 


> 















DW 



Defines constant word data: 
(Note: odd length text strings 
are padded with nulls) 



58FD>DW 1,2,3,4, "TEST", 
58FD 0100 0200 0300 0400 4554 

5453 0000 
590D > 



PRE 



Toggles to preview mode 
(causes next instruciton to be 
disassembled): 



6590 >PRE 

6590 C6470234 MOV BYTE PTR 
[BX+2H],34H 



Toggles out of preview mode: 



6590 C6470234 MOV BYTE PTR 
[BX+2H],34H 
>PRE 
6590> 
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ASSEMBLER DIRECTIVES ( cont.) 



EQU 



Defines/redefines local symbol 
(L0-L9): 
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6590 >L3 EQU 7A44H 
6590 > 



or if symbolic debug hardware 
is installed: 



6590 > 'Unit EQU 0FDEOH 
6590 > 



L0,L1...L9 



Prints value of local symbol: 



756A 


>L3 






756A 


>L3 


EQU 


7A44h 


756A 


> 







<symbol> 



Prints value of symbol. This is 
only valid if symbolic debug 
hardware is installed: 



756A 


> 


Unit 






756A 


> 


Unit 


EQU 


FDEOH 


756A 


> 









ASSEMBLER DIRECTIVES (cont.) 



RETURN 



Disassembles one instruction at 
the current address: 



5D0A > 




5D0A 3306AD78 


XOR AX, WORD 


PTR 781DH 




5DE > 





$ 



Current assembler offset 
address. 



NEAR 



Within current line assembly 
segment. 



FAR 



Outside current line assembly 
segment. 
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MEMORY DISASSEMBLER 



Command 



Result 



DIS <range> 



Disassembles and displays the 
data in the specified range. 



DIS <address> 



Disassembles one page of 
memory beginning at a 
specified address. 



DIS 



Disassembles and displays a 
page of memory beginning at 
the last address display during 
previous DIS command. At 
power-up this value is zero. 



Comments 



You should be familiar with 80286 assembly language programming and 
have the Intel iAPX286 Hardware Reference Manual and the Intel 
iAPX286 Programmer's Reference Manual. 

Page length is defined by the CRT length parameter in the SET menu 
(page 5-3). 
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MEMORY DISASSEMBLER (cont.) 



The disassembly can be continued by typing a <space> or |return| . Exit 
disassembly by typing any other character. 



<space> 



Continues disassembling one 
line at a time. 



RETURN 



Continues disassembling one 
page at a time. 



any char except <space> or 



RETURN 



Exits disassembly mode. 
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Memory and I/O Modes 

MEMORY MODE 

Memory mode allows you to view and modify memory using a simple 
scrolling scheme. Enter memory mode by executing the M command. The 
current address and associated data are display ed. If t he first character 
entered on a memory mode command line is a [ return U the next address 



and its data are displayed. If a value is entered before the [ return | , that 



value is written to the current address before displaying the next address. 
A list of up to nine values separated by commas may be entered after a 
memory mode prompt. This data is stored to consecutive addresses. 

The scroll direction is determined by two commands, NXT and LST. NXT 
(next) increments the address and LST (last) decrements the address. 
Entering either of these commands during run or pause mode sets the scroll 
direction. The scroll direction can also be changed after you have already 
entered memory mode by executing the appropriate command. The scroll 
direction can be manually overridden at any time by using the period □ 
and comma □ keys. A period increments the address; a comma decrements 
it. 

The MMP register (memory mode pointer) is always set to the current 
address being accessed. If memory mode is entered without specifying an 
address, the value in this register specifies the starting address. On power- 
up, MMP is set to zero. (For further information on MMP see page 6-62.) 

I/O MODE 

I/O mode allows viewing and modification of the data in I/O address 
space. I/O mode is entered with the MIO command. Data is not 
automatically read from an I/O address on entry to I/O mode. Many I/O 
ports are "write only" ports, and trying to read from them may cause 
hardware problems. In order to read data from an I/O port, you must enter 
a Ireturni as the only character on the line. The data is displayed, but the 
address is not automatically incremented. You must manually change the 
address while in I/O mode using the period and comma keys. A Q 
increments the address and a □decrements the address. Up to nine values 
separated by commas can be entered in response to the I/O mode prompt. 
All of the values in the list are written to the same I/O address. 
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Section 6: Target Commands 



The IOP register (I/O pointer) is always set to the current I/O address 
being accessed. If I/O mode is entered without specifying an address, the 
value in this register will determine the starting address. On power-up, 
IOP is set to zero. (For further information on IOP, see page 6-61 .) 
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ENTER MEMORY MODE 



Command 



Result 



M <address> 



Enters memory mode at 
<address>. The address and the 
data at that address are 
displayed preceding the prompt. 



M 



Enters: memory mode at the last 
address examined in a previous 
memory mode session. 

The last address is stored in the 
MMP register, (Memory Mode 
Pointer). At power-up, this 
value is zero. 

Exits memory mode. 



Comments 



The M command affects real time operation when entered in run mode (see 
pages 6-18, 6-19, and 6-31). 

Data displayed in memory mode can be in either byte or word lengths. Set 
byte mode (BYM) or word mode (WDM) before entering memory mode. If 
you are in word mode and enter a byte of data, the byte is padded with 
zeroes and a word is written. If you are in byte mode and enter a word of 
data, the value is truncated, and only a byte is written. (See page 4-26.) 

The MMP register is modified if you scroll to a new address while in 
memory mode. When you exit memory mode, MMP reflects the last 
address examined. 
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ENTER MEMORY MODE (cont.) 



When a |return| is entered as the first character on a line, the address is 
incremented or decremented and the new address and data are displayed. 
On power-up, the default scroll mode is toward increasing memory 
addresses. To change the scrolling direction use the NXT (forward) and 
LST (backward) commands. These can be entered in memory mode. If 
they are entered in pause mode, the scroll mode is set and memory mode is 
entered at MMP. 

The scroll mode can be overridden by using the period and comma keys. A 
□ increments the address and a □ decrements the address. 



To modify data at a memory location, enter the data and press Ireturn 



The data is written to the current address and the next address and data are 
displayed. 

Data can be entered quickly using a list. A list can contain up to nine 
values separated by commas. See example below. 



Examples 



Set the MMP and use the NXT command to enter memory mode. Change a 
word of data and verify. 



>WDM; MMP=$FF000; NXT 
S0FF000 $1234 >1122 
$0FF001 $00FF >, 
$0FF000 $1122 >X 
> 
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ENTER MEMORY MODE (cont .) 



Assume that address 1000H is the start of a data table and you want to 
write a short program to utilize that data. 

Initialize the data using a list. Then invoke the line assembler using MMP 
as the start address (page 6-44, 6-62). 



>M 1000 

$001000 $00 >0,1,2,3,4, 5,6,7,8 
$001009 $00 >X 
>ASM MMP 
**** 80286 LINE ASSEMBLER VX.XLA **** 

1009 > Enter your program here. 

Use 'X' or 'END' to exit 
the line assembler. 
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ENTER I/O MODE 



Command 



Result 



MIO <address> 



Enters I/O mode at <address>. 
The port address is displayed, 
but no data is read until a 
IreturnI is entered as the first 
character on the line. 



MIO 



Enters I/O mode at the last 
address examined in a previous 
I/O mode session. 

This address is stored in the IOP 
(I/O mode pointer) register. At 
power-up, this value is zero. 



X 



Exit I/O mode. 



Comments 



Affects real time operation when entered in run mode (see pages 6-18, 
6-19, and 6-31). 

The IOP is modified by scrolling to a new address while in I/O mode. 
When you exit I/O mode, the IOP reflects the last address examined. (See 
IOP, page 6-61.) 

To read from an I/O port, en ter I/O mode using one of the above 
commands, and enter a IreturnI as the first character following the I/O 
mode prompt. The value of the current address is displayed. 
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ENTER I/O MODE (cont.) 



To write to the I/O port, enter the value and press [return]. The value is 
written and the current address redisplayed. 

Data can be entered quickly using a list. A list contains up to nine values 
separated by commas. All of the values in a list are written to the same 
address. The values are written 6 ms apart. 

Addresses are not automatically incremented or decremented. Scrolling 
the address in I/O mode must be done manually, by using the period to 
increment the address, and the comma to decrement the address. 



Examples 



Enter I/O mode, write to a port and verify. 



>MIO $2F00 
IO:$2F00 >$7F 
IO:$2F00 > 
IO:$2F00 $7F >X 



Set word mode and enter I/O mode at the last address, increment the 
address and read the data. 



>WDM; MIO 






10 


,$2F00 


>. 




10 


:$2F01 


> 




10 


:$2F01 


S05A6 


>X 


> 
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EXIT MEMORY AND I/O MODES 



Command Result 



X Exits memory or I/O mode. 
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SCROLLING IN MEMORY MODE 



Command 



Result 



RETURN 



Scrolls through memory 
addresses either one byte (8 bits) 
at a time, or one word (16 bits) 
at a time. 



LST 



RETURN 



The 
decrements 
memory mode. 



key now 
addresses in 



NXT 



The 



RETURN 



key 



now 



increments (default mode) 
addresses in memory mode. 



Increments the 
memory mode. 



address in 



Comments 



Decrements the address in 
memory mode. 



The NXT and LST commands may be entered from pause, ru n, or memory 
mode. If entered from run or pause mode, the Ireturni key is set to 
increment or decrement. 

When a comma or period is entered in memory mode, this temporarily 
overrides the scrolling direction. 
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I/O MODE POINTER 



Command 



Result 



IOP 



Displays the current value of 
the I/O mode pointer. 



IOP = <exp> 



Assigns the value <exp> to the 
I/O mode pointer. 



Comments 

IOP is the last value examined while in I/O mode. If you enter I/O mode 
without specifying an address, the IOP value is used as the entry point. 

The default power-up value of the IOP register is zero. This register may 
be stored in EEPROM. 

The I/O mode pointer is modified by moving to a new address after 
entering I/O mode. When you exit I/O mode, the IOP reflects the last 
address examined. As with any register, the IOP can be used as a 
parameter for other commands (see Memory and I/O Modes, page 6-52). 



Examples 



Set the IOP and verify. 



>IOP=$1100;IOP 
$00001100 
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MEMORY MODE POINTER 



Command 



Result 



MMP 



MMP - <exp> 



Displays the current value of 
the memory mode pointer. 

Assigns the value <exp> to the 
memory mode pointer. 



Comments 



MMP is the last value examined while in memory mode. If you enter 
memory mode without specifing an address, the MMP value is used as the 
entry point. 

The default power-up value of the MMP register is zero. This register 
may be stored in EEPROM. 

The memory mode pointer is modified if you change to a new address after 
entering memory mode. When you exit memory mode, the MMP reflects 
the last address examined. 

As with any register, the MMP can be used as a parameter to another 
command. (See memory and I/O modes, page 6-52.) 
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MEMORY MODE POINTER (cont.) 



Examples 



Set the MMP and verify. 



>MMP=$12330;MMP 
$00012330 
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Diagnostic Functions 

The diagnostic functions (also called special functions or SFs) are a group 
of utility routines and special tests. They are valuable for locating address, 
data, status or control line problems. There are two categories: 

■ RAM tests 

■ Scope loops 

For a complete list see the SF command (page 6-66). 

RAM TESTS 

The prewritten tests check that RAM is operating properly. They can be 
run on the target or overlay memory and may be executed in either byte or 
word mode. Byte or word mode must be specified prior to initiating the SF 
test. 

SF 1 and 3 are modeled after a study by Abraham, Thatte, and Narir 
entitled Efficient Algorithms for Testing Semiconductor Random-Access 
Memories [IEEE Transaction on Computers, vol. c-27, no. 6 June 1978]. 
Refer to this publication for background information on these two 
diagnostics. 

If you are going to test a large chunk of RAM, it may take a significant 
amount of time. If you attach a printer to the computer port and turn on 
the copy switch, you can let the test run while you do something else. The 
printer will record any errors that may occur in your absence. 

SCOPE LOOPS 

Scope loops are diagnostic routines built into the Emulator firmware for 
use when troubleshooting with an oscilloscope. The uses for these special 
functions range from locating stuck address data, status or control lines, to 
generating signatures using signature analysis equipment. Special 
Functions 4 through 12 are the memory scope loops and 24 through 32 are 
the I/O scope loops. 

The firmware is optimized so that the loops execute at maximum speed. 
This short cycle time allows the hardware engineer to review the timing of 
pertinent signals in the target system without using a storage oscilloscope. 
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Section 6: Target Commands 



All of these routines must be terminated by resetting the Emulator with the 
reset character (see pages 4-29 and 6-29). The scope loops can be executed 
in either byte or word mode. 
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SPECIAL FUNCTIONS LIST 



Command 



Result 



SF 



Displays list of all available 
RAM tests, scope loops and 
miscellaneous tests. 



Examples 



>SF 

SF 0,<RANGE><CR> 
SF 1,<RANGE><CR> 
SF 2,<RANGE><CR> 
SF 3,<RANGE><CR> 

SCOPE LOOPS: {SELECT NUMBER FOR I/O 
SF 4 <24>,<ADDRESS>,<PATTERN><CR> 
SF 5 <25>,<ADDRESS><CR> 
SF 6 {26>,<ADDRESS>,<DATA><CR> 
SF 7 {27},<ADDRESS>,<PATTERN><CR> 
SF 8 {28>,<ADDRESS>,<PATTERN><CR> 
SF 9 {29>,<ADDRESS>,<DATA><CR> 
SF 11 {31>,<ADDRESS>,<DATA><CR> 
SF 12 <32>,<RANGE><CR> 
MISCELLANEOUS: 
SF 13<CR> 
CLK <CR> 
CRC <RANGE><CR> 
CRE/CRO <RANGE><CR> 
> 



SIMPLE RAM TEST, SINGLE PASS 
COMPLETE RAM TEST, SINGLE PASS 
SIMPLE RAM TEST, LOOPING 
COMPLETE RAM TEST, LOOPING 
LOOPS> 
TOGGLE DATA AT ADDRESS 
READ FROM ADDRESS 
WRITE DATA TO ADDRESS 
WRITE PATTERN, THEN PATTERN COMPLEMENT 
WRITE PATTERN, THEN ROTATE 
WRITE DATA, THEN READ 
WRITE INCREMENTING VALUE 
READ DATA OVER ENTIRE RANGE 

CRC CHECK OF EMULATOR FIRMWARE 
DISPLAY TARGET CLOCK FREQUENCY 
CALCULATE CRC OF SPECIFIED RANGE 
CALCULATE CRC OF EVEN/ODD BYTES ONLY 
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SIMPLE RAM TEST, SINGLE PASS 



Command 



Result 



SF 0, <range> 



Writes a test pattern to all 
locations within the specified 
range, then reads each location 
to verify the data. The 
following pattern sequence is 
used: 







Pattern 






Sequence 


BYM 




WDM 


1 


0000 


0000 


0000 


0000 


0000 0000 


2 


0000 


0001 


0000 


0000 


0000 0001 


3 


0000 


0011 


0000 


0000 


0000 0011 


4 


0000 


0111 


0000 


0000 


0000 0111 


5 


0000 


1111 


0000 


0000 


0000 1111 


6 


0001 


1111 


0000 


0000 


0001 1111 


7 


0011 


1111 


0000 


0000 


0011 1111 


8 


0111 


1111 


0000 


0000 


0111 1111 


9 


1111 


1111 


0000 


0000 




10 


1111 


1110 


0000 


0001 




11 


1111 


1100 


0000 


0011 




12 


1111 


1000 


0000 


0111 




13 


1111 


0000 


0000 


1111 




14 


1110 


0000 


0001 


1111 




15 


1100 


0000 


0011 


1111 




16 


1000 


0000 


0111 


1111 


1111 1111 
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SIMPLE RAM TEST, SINGLE PASS (cont.) 



Comments 



This command is valid in pause mode only. 

If a location is read that does not match the test pattern, a failure is 
reported. 

The address, correct data, and faulty data is displayed. 

If no failure is detected, the following prompt is displayed: 



TESTING RAM 
COMPLETE 



This is a single pass test. 
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COMPLETE RAM TEST, SINGLE PASS 



Command 



Result 



SF 1 , <range> 



Writes, then reads, a test pattern 
to all locations in the specified 
range. Refer to Efficient 
Algorithms for Test Semi- 
conductor Random-Access 
Memories mentioned in the 
introduction to Diagnostic 
Functions for the test pattern. 



Comments 



This command is valid in pause mode only. 

If an error is detected, the associated address, correct data, faulty data, and 
test sequence number are displayed. The sequence number specifies which 
test in the complete list of tests caused the failure. 

This is a single pass test. 



Examples 



TEST FAILED AT $20;GOOD DATA-$00, BAD DATA-$01 SEQ#-$02 



An error is detected. 
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SIMPLE RAM TEST, LOOPING 



Command 



Result 



SF 2, <range> 



Writes a test pattern to all 
locations in <range>, then reads 
each location to verify the data. 
See SF for test pattern. Each 
time the test is executed, the 
pass count is incremented and 
displayed on the screen. 



Comments 



This command is valid in pause mode only. 

If no failure is detected, the pass line is the only line displayed. It is 
continually updated, showing the number of times the test has been 
executed. 



SF 2, o TO 4 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 

PASS COUNT = $XXXX 
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SIMPLE RAM TEST, LOOPING (cont.) 



If a failure is detected, the problem address, correct data, and faulty data 
are displayed on the line after the pass number line, and the test continues. 



>SF 2,0 TO 4 






YOU MUST RESET ME TO TERMINATE 


THIS FUNCTION 




TEST FAILED AT $02; GOOD DATA ■ 


$FE, BAD DATA 


■ $FF 


PASS COUNT = $0000 






TEST FAILED AT $02: GOOD DATA ■ 


$FE, BAD DATA 


$FF 


PASS COUNT $0001 






until reset 







You must issue the reset character to terminate this test (see pages 4-29 and 
6-29). 
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COMPLETE RAM TEST, LOOPING 



Command 



Result 



SF 3, <range> 



Writes a test pattern to all 
locations within <range>, then 
reads each location to verify the 
data. See SF 1 for test reference 
information. 



Comments 



This command is valid in pause mode only. 

During execution, a pass count is maintained and displayed on the screen. 

If no failure is detected, the pass line is the only line. It is continually 
updated, showing the number of times the test has been executed. 



>sf 3, o to 2 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
PASS COUNT = $XXXX 
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COMPLETE RAM TEST, LOOPING (cont.) 



If a failure is detected the associated address, the correct data, faulty data, 
and test sequence number are displayed. 



>SF 3, TO 2 
YOU MUST RESET ME TO TERMINATE THIS FUNCTION 

TEST FAILED AT $02; GOOD DATA ■ $00, BAD DATA - $01 SEQ # - 02 
PASS COUNT $0000 

TEST FAILED AT $02; GOOD DATA - $00, BAD DATA - $01 SEQ # - 02 
PASS COUNT $0001 



until reset 



You must issue the reset character to terminate this test (see pages 4-29 and 
6-29). 
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TOGGLE DATA AT ADDRESS 



Command 



Result 



SF 4 <address>,<data> 



<data> is written to the 
specified address in the memory 
space. 



SF 24,<address>,<data> 



<data> is written to the 
specified address in I/O space. 

The user defined data pattern is 
written to < address>, 
alternating with a data pattern 
of zeros. 



Comments 



SEQ 


BYM 


WDM 


1 


00 


0000 


2 


XX 


XXXX (user data) 


3 


00 


0000 


4 


XX 


XXXX (user data) 


■ 


■ 


■ 


• 


■ 


• 


■ 


■ 


■ 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-29 and 
6-29). 
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TOGGLE DATA AT ADDRESS (cont.) 



Examples 



Assume you are in word mode (WDM). 



>SF 4, 2, $FFFF 
YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



The data pattern written to address 2 is: 
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PEEKS INTO THE TARGET SYSTEM 



Command 



Result 



SF 5,<address> 



Consecutively reads from the 
specified memory address. 



SF 25,<address> 



Consecutively reads from the 
specified I/O address. 



Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-29 and 
6-29). 



Examples 



>SF 5, 2 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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POKES INTO THE TARGET SYSTEM 



Command 



Result 



SF 6,<address>,<data> 



Consecutively writes the user 
defined data pattern to the 
specified memory address. 



SF 26,<address>,<data> 



Consecutively writes the user 
defined data pattern to the 
specified I/O address. 



Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-29 and 
6-29). 



Examples 



>SF 6, 10,$FFFF 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



(continued) 
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POKES INTO THE TARGET SYSTEM (cont.) 



The data pattern written to address 10 is: 



(BYM) (WDM) 

FF FFFF 

FF FFFF 

FF FFFF 
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WRITE ALTERNATE PATTERNS 



Command 



Result 



SF 7 \<address>,<pattern> 



Consecutively writes the user 
defined data pattern to the 
specified memory address, 
followed by the complement of 
that data pattern to the same 
address. 



SF 27 \<address>,<pattern> 



Consecutively writes the user 
defined data pattern to the 
specified I/O address followed 
by the complement of that data 
pattern to the same address. 



Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-29 and 
6-29). 



Examples 



>SF 7, 10, 55 
YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



(continued ) 
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WRITE ALTERNATE PATTERNS ( cont .) 



The following data pattern is written to address 10: 



BYM 


WDM 


55 


0055 


AA 


FFAA 


55 


0055 


AA 


FFAA 


" 


■ 
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WRITE PATTERN THEN ROTATE 



Command 



Result 



SF 8, <address> i <pattern> 



Consecutively writes the data 
pattern to the specified memory 
address, rotates the pattern 1 bit 
to the left, and writes to the 
same address. 



SF 28, <address>, < patter n> 



Consecutively writes the data 
pattern to the specified I/O 
address, rotates the pattern 1 bit 
to the left, and writes to the 
same address. 



Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-29 and 
6-29). 



Examples 



>SF 8,1000,05 
YOU MUST RESET ME TO TERMINATE THIS FUNCTION 



(continued ) 
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WRITE PATTERN THEN ROTATE (cont.) 



The following data pattern is written to address 1 0: 



BYM 


WDM 


05 


0005 


0A 


000A 


14 


0014 


28 


0028 


50 


0050 


A0 


00A0 


41 


0140 


82 


0280 




0500 




0A00 




1400 




2800 




5000 




A000 




4001 




8002 
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WRITE DATA THEN READ 



Command 



Result 



SF 9, <address> i <data> 



Consecutively writes the 
specified data pattern to the 
specified memory address, then 
reads from that same address. 



SF 29, <address>, <data> 



Consecutively writes the 
specified data pattern to the 
specified I/O address, then 
reads from that same address. 



Comments 



These commands are valid in pause mode only. 

You must issue a reset character to terminate this test (see pages 4-29 and 
6-29). 



Examples 



>SF 9, 100,$FFFF 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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WRITE INCREMENTING VALUE 



Command 



Result 



SF 11, <address> 



Consecutively writes a 
constantly incrementing value 
to the specified memory 
address. 



SF 31, <address> 



Consecutively writes a 
constantly incrementing value 
to the specified I/O address. 



Comments 



These commands are valid in pause mode only. 

You must issue the reset character to terminate this test (see pages 4-29 and 
6-29). 



Examples 



>SF 11, 100 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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READ DATA OVER AN ENTIRE RANGE 



Command 



Result 



SF 12, <range> 



Consecutively reads from the 
specified memory address 
range. 



SF 32, <range> 



Consecutively reads from the 
specified I/O address range. 



Comments 



These commands aire valid in pause mode only. 

The Emulator performs consecutive reads over the specified address range. 
The first read occurs at the starting address of the range. The address is 
then incremented for each additional read cycle. After the last address in 
the range has been read, the process starts again. 

You must issue the reset character to terminate this test (see pages 4-29 and 
6-29). 



Examples 



>SF 12, 10 TO 20 

YOU MUST RESET ME TO TERMINATE THIS FUNCTION 
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CYCLIC REDUNDANCY CHECK 



Command Result 



SF 13 A CRC is calculated on the ES 

1800 internal PROM that 
contains the Emulator 
firmware. 



Comments 



This command is valid in pause mode only. 

This is an Emulator self- test. 

If a failure is detected, a CRC error is displayed. 

This is a single pass routine. 

When the text completes without an error, the command prompt ( [>] ) is 
displayed. 
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READ TARGET SYSTEM CLOCK 



Command 



Result 



CLK 



Reads the target system clock 
and displays the value in KHz. 
The value is accurate to plus or 
minus 2 KHz. 



Examples 



>CLK 
CLOCK FREQUENCY =: #2001 KHZ 
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TARGET CYCLIC REDUNDANCY CHECK 



Command 



Result 



CRC <address> 



The system calculates a cyclic 
redundancy check on all data 
bytes in address <range>. 



CRE < address range> 



Calculates a cyclic redundancy 
check on even addressed data 
bytes in <range>. 



CRO < address range> 



Calculates a cyclic redundancy 
check on odd addressed data 
bytes in <range>. 



Comments 



These commands are valid in pause mode only. 

The CRC command generates a cyclic redundancy check value over a user 
defined address range. Only the byte mode is used for this test. 

If code is split into two PROMs, with one even and the other one odd, the 
CRE/CRO commands allow you to do a cyclic redundancy check on each 
PROM. 

CRC calculations can be used to determine if FLAM based data is being 
corrupted. Do a CRC over the data base and save the value. Then run the 
program and do the CRC over the range again. If the values do not match, 
data is being corrupted. The Event Monitor System can be set up to catch 
writes to the data base. The CRC algorithm is based on the polynomial 
X 16 +X 15 +X 2 +l. 
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DISPLAY STATUS OF STATUS LINES 



Command 



Result 



BUS 



Displays the state of the CPU's 
bus control signals. 



Comments 




The status of the following bus lines is displayed: 


vcc 


Power 


RST 


Reset 


ALE 


Address Latch Enable 


RDY 


Ready 


HDA 


Hold Acknowledge 


INT 


Interrupt 


NMI 


Non-maskable Interrupt 


HLT 


Halt 


SDN 


Shutdown 


PRQ 


Processor Extension Request 


PEA 


Processor Extension Acknowledge 


BSY 


Busy 


ERR 


Error 



(continued ) 
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DISPLAY STATUS OF STATUS LINES (cont.) 



(T) 


Toggling 


1 


Asserted 





Inactive 



If a signal maintains a steady state for longer than 1 ms., a "1" or a "0" 
appears. 

If a signal toggles within the 1 ms. sampling window, a "(T)" appears. 



Examples 



The following is an example of the screen display: 



>BUS 


























VCC 


RST 


ALE 


RDY 


HDA 


INT 


NMI 


HLT 


SDN 


PRQ 


PEA 


BSY 


ERR 


1 


(T) 


<T> 


<T> 


<T) 


<T> 


(T) 


<T) 


(T) 


(T) 












indicates an inactive condition. 1 indicates an active condition. 
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EVENT MONITOR SYSTEM 



Overview 

The ES1800's Event Monitor System provides extremely flexible system 
and breakpoint control, enabling you to isolate or break on any predefined 
series of events and then perform various actions. You control and 
monitor the target by entering commands that define events as logical 
combinations of address, data, status, count limit, and optional logic state 
probe inputs. When an event is detected, the ESI 800 can break emulation, 
trace specific sequences, count events, execute user supplied target 
routines, and trigger TTL outputs. 

WHEN/THEN control statements define events and the corresponding 
actions. There can be several actions for any event. The system only 
recognizes the first 3 letters of any word in a control statement (e.g., 
WHEN=WHE; THEN=THE). There can be many control statements in 
effect at any time. The Event Monitor System can also switch groups or 
states. There are four event groups available and the control statements 
and comparator values for any group are independent of those in other 
groups. 

You can enter Event Monitor System control statements while in run mode. 
You can also modify the event comparator values during run mode. These 
new statements and values will not go into effect until you stop and restart 
run mode. 
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The ESI 800 Event Monitor System monitors target information at the bus 
cycle level, including every read or write cycle that the microprocessor 
executes. The EMS "sees" every signal that can affect the target system. It 
can also monitor inputs from the logic state analyzer probe. 

The EMS essentially takes a picture of the microprocessor's signals at the 
end of every TC02 state (refer to the Intel manual, 80286 Microprocessor 
Users Manual). The information that is recorded into trace memory is the 
same information that the EMS is monitoring. 

The basic Event Monitoring System control statement is of the form: 



[Group] WHE[N] <event> THE[N] <action> 



Notice that the ESL command processor needs only the first three letters of 
the symbol. 

COMPARATOR REGISTERS 

There are eight comparator registers for each of the four event groups. 
These event registers are listed in the table below. The address 
comparators are used to detect discrete addresses or addresses inside or 
outside a specified range. The data comparators can detect specific data 
patterns and can ignore specified bit positions. The status comparators 
monitor all of the status signals from the microprocessor as well as some 
generated by the ESI 800. The status comparators can also ignore bit 
positions. The count limit register can be used to detect when an event has 
occurred more than a specified number of times. The logic state analyzer 
register can detect bit patterns in the inputs from the logic state probe. 
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The following table describes the available event comparator registers. 



Register 




Size 


Name by Group 




Description 


Type 


(bits) 


1 


2 


3 


4 


Address 1 


Range, I nt 


24 


AC1 or AC1.1 


AC1.2 


AC1.3 


AC1.4 


Address 2 


Range, I nt 


24 


AC2 or AC2.1 


AC2.2 


AC2.3 


AC2.4 


Data 1 


Don't Care,Int 


16 


DC1 or DC1.1 


DC1.2 


DC1.3 


DC1.4 


Data 2 


Don't Care,Int 


16 


DC2 or DC2.1 


DC2.2 


DC2.3 


DC2.4 


Status 1 


Don't Care,Int 


16 


S1 or S1.1 


S1.2 


S1.3 


S1.4 


Status 2 


Don't Care,Int 


16 


S2 or S2.1 


S2.2 


S2.3 


S2.4 


LSA 


Don't Care,Int 


16 


LSA or LSA.1 


LSA. 2 


LSA. 3 


LSA. 4 


Count 


Int 


16 


CTL or CTL.1 


CTL. 2 


CTL. 3 


CTL. 4 



ADDRESS COMPARATORS 

Address comparators may be assigned integer values or range values. 
Ranges may be either internal (IRA) or external (XRA). If a range is 
specified without IRA or XRA operators, the default range type will be 
IRA. The following are examples of valid address comparator 
assignments. 
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>AC1=2000 
>AC2=1000 LEN 20 
>AC2.2=XRA 1100 TO 1250 
>AC1.4 = IRA $FF006 LEN $FF 
>AC1.1 = aSS:SP 
>AC2=' Symbol 
>AC1 =IP + 200 
>AC1.2 = SAC1.4 



DATA AND LSA COMPARATORS 

The data comparators monitor the data bus for specified patterns. The 
LSA comparators monitor the input pulses from the logic state probe. 

Data and LSA comparators may be assigned integer values or don't care 
values. Don't care values allow specified bits to be monitored while other 
specified bits are ignored. 

For example: 



0040 DC FFBF 



In this case the Emulator monitors bit 6 for a high value and ignores the 
remaining bits. 

Don't care values may be assigned in two ways. 

■ The first is to specify the value followed by the don't care 
mask 

■ The second is to specify the value using [x] in the don't care 
positions. 

The following are examples of valid data and LSA comparator 
assignments. 



7-4 



Section 7: Event Monitor System 



>DC1 = 


=237F 




>LSA= 


=5300 DC $FIF 




>LSA 


.3 = 53XX 




>LSA 


= %1 10101 DC $FF00 




>DC2 


2 = 42 DC %101 




>DC2 


= GDO + $F 




>DC1 


4 = a'data table + 


56 



STATUS COMPARATORS 

Status information in the trace buffer represents miscellaneous bit 
information that is accessible on the bus every bus cycle. This 
information, as with all traced information, can be used to qualify the 
Event Monitor System. The following charts outline the various bit 
information associated with the status comparators (SI and S2) of the 
Event Monitor System. These terms (WRD, BYT, IF, etc.) are to be used 
when setting SI and S2 to a new value. Refer to the Intel iAPX286 
Hardware Reference Manual and the Intel iAPX286 Programmer's 
Reference Manual published by the Intel Corporation. 
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STATUS 


MNEMONICS 




MNEMONIC 


VALUE 








DESCRIPTION 


URD 


$0000 


MASK 


(DC) - 


$FFFE 


Word access 


BYT 


$0001 


MASK 


(DC) - 


$FFFE 


Byte access 


WR 


$0000 


MASK 


(DC) - 


$FFFD 


Write cycle 


RD 


$0002 


MASK 


(DC) - 


$FFFD 


Read cycle 


OVL 


$0000 


MASK 


(DC) - 


$FFFB 


Overlay access 


TAR 


$0004 


MASK 


(DC) - 


$FFFB 


Target access 


IOA 


$0000 


MASK 


(DC) - 


$FFF7 


I/O access 


MEM 


$0008 


MASK 


(DC) - 


$FFF7 


Memory access 


NMI 


$0020 


MASK 


(DC) - 


$FFDF 


NMI cycle 


IAK 


$0000 


MASK 


(DC) - 


$FF27 


Interrupt acknowledge 


RIO 


$0090 


MASK 


(DC) - 


$FF27 


I/O read 


UIO 


$0050 


MASK 


(DC) - 


$FF27 


I/O write 


HSD 


$0008 MASK 


(DC) - 


$FF27 


A0 high = halt 












AO low = shutdown 


RM 


$0088 MASK 


(DC) - 


$FF27 


Memory read 


WM 


$0048 


MASK 


(DC) - 


$FF27 


Memory write 


IF 


$0098 


MASK 


(DC) - 


$FF27 


Instruction fetch 


LOK 


$0000 


MASK 


(DC) - 


$EFFF 


Locked bus cycle 


PEA 


$0000 


MASK 


(DC) - 


$DFFF 


Processor extension ack 


QF 


$4000 


MASK 


(DC) - 


$BFFF 


Que flush 


DC is don 


t care 


value 
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The status mnemonic table shows which status values can be assigned to 
the comparators. You may assign a status comparator a single mnemonic, 
or you may combine a mnemonic from each of the columns 1-4 and any or 
all from column 5. Mnemonics are combined using an addition operator 
( ) as a Boolean AND. 









STATUS MNEMONIC TABLE 




1 


2 


3 




4 




5 


S1 : 


= TAR 


+ RD 


+ BYT 


+ 


IAK 


+ 


QF 


S2 


OVL 


WR 


WRD 




RIO 

RM 

WIO 

WM 

IF 

MEM 

IOA 

HSD 




NMI 
LOK 
PEA 



Some examples of status comparator assignments: 



>S1=BYT 

>S2=OVL+RD+QF 

>S1.3=WR+WRD 

>S2.4=RIO 

>S1.2=QF 
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Figure 9. Status Translation Table 



15 




X4 


12 


11 


X3 


8 


7 




X2 


4 


3 


XI 








































1 

N/U 



i 
QF=1 



I 
PEA=0 



1 
LOK=0 



I 
RESERVED 



i 
•SO 



1 
•>S1 



i 

NMI-1 



•COD,' 

INTA 
1 



1 
•IOA=0 
MEM=1 

i 



I 
OVL=(l 
TAR=I 



4. 

WR=0 
RD=1 



i 
WRD=0 
BTI'=1 



These bits are decoded for the following information: 
IAK=0000 
RIO0090 
WIO=0050 
HSD=0008 
RM=0088 
WM=0048 
IF=0098 



When you display the value of the status comparators, you will see a 32-bit 
don't care value rather than the mnemonics you originally assigned them. 
The Status Translation Table is provided to aid you in decoding the 
numbers back into the mnemonics. 

The don't care mask is the value to the right of the DC. A "0" in a mask 
bit position enables the status bit in the same position on the left side of the 
DC, and a "1" in a mask bit position masks or disables the corresponding 
bit on the left side of the DC. 

Determine which bit positions are unmasked (those containing 0's in the 
mask value). It may be easier to do this by setting the status comparator's 
display base to binary ( |bas si = z\ ). Then refer to the translation table and 
find the unmasked bit positions. Look at the value contained on the left 
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side of the DC and match it with the corresponding value shown 
underneath the bit position in the table. 



>S1 
$000000A8 DC 0000FF07 



All bits except bits 3, 4, 5, 6 and 7 are masked. Bit 5 is enabled and a 1 is in 
the bit 5 of the status value, so NMI was entered. 

Bits 3, 4, 6, and 7 are enabled and there is a 1001 in those bits in the status 
value so RM was entered. 

Therefore, the original input was: 



>S1=NMI+RM 



COUNT LIMIT COMPARATOR 

The count limit comparator, CTL, is used to detect when events have 
occurred a certain number of times. The CTL value for group 1 is loaded 
into a hardware counter which is decremented whenever the action CNT is 
executed (see the following section on actions). If a group switch occurs, 
the hardware counter can be loaded with the new group's count limit by 
executing the RCT (reset count) action. Otherwise, the hardware counter 
does not change its limit value when switching groups. 
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Defining Events 

The Event Monitor System is arranged in four independent groups. These 
groups provide a state-machine capability for debugging difficult 
problems. EMS control statements are associated with one of the four 
groups. If no group numbers are mentioned in the EMS control statement, 
the statement is assigned to group 1 . There are two ways to override this 
default selection of group 1. You can begin the EMS control statement 
with a group number, or you can add a group number to any one of the 
event comparator names. For example: 13 when act then brk| is functionally 
the same as |when act. 3 then brk|. You cannot mix group numbers within a 



single EMS control statement. 



EVENT 



You can define an event to be some combination of address, data, status, 
count, and logic state probe conditions. Numerous Event Monitor System 
control statements may be entered and in effect simultaneously. 
Conflicting statements may cause unpredictable action processing. 
Parentheses are not allowed in event specifications. 

The NOT operator reverses the sense of the comparator output. NOT has 
higher precedence than either of the conjunctives. 
when aci and not pel then brk| means break whenever any data pattern other 



than that in DC1 is written to an address in ACI . 

AND and OR can be used where needed to form more restrictive event 
definitions. AND terms have higher precedence than OR terms. 



aci and dci or dc2| is the same as |aci and dcTI in one statement and [dc2] in 



another. If you are looking for two different data values at am address, you 

WOuld USe |AC1 AND DC1 OR AC1 AND DC2 |. 

The OR operator is evaluated left to right and is useful for simple 
comparator combinations. For complex event specifications, OR 
combinations can be replaced with separate EMS Control s tatements for 
clarity. Iaci and si or ac2 and S2| is the same as [aci and si] and [ ac2 and s2 . 
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Defining Action Lists 

The action list in a WHEN/THEN statement defines what the Emulator 
does when an event is detected. Actions are specified in an action list 
separated by commas. The action list may have one or more actions 
defined. 



<group> WHEN <event> THEN <action>,<action>, ... ,<action> 



The following table lists all possible actions. 

Event Monitor System Actions 



Action 


Description 


BRK 


Break emulation 


CNT 


Count bus cycle 


FSI 


Force special interrupt 


GRO n 


Change event group 


RCT 


Reset count value 


TGR 


Output trigger signal 


TOC 


Toggle count state 


TOT 


Toggle trace state 


TRC 


Trace bus cycle 



The TRC and TOT actions are described in the Tracing Events section. 
The CNT, RCT, and TOC actions are described in the Counting Events 
section. The FSI action is described in the Special Interrupt section. The 
GRO action is described in the Changing Event Groups section. The TGR 
action is described in the Trigger Signal section. The BRK is described in 
the Breaking Emulation section. 
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DISPLAY EVENT SPECIFICATIONS 



Command Result 



DES Displays all of the 

WHEN/THEN statements 
currently active from all groups. 

DES < group number > Displays all of the 

WHEN/THEN statements and 
the comparator values for the 
specified group. 
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Examples 



Displays the statements and comparators for groups 1 and 2. 



>DES 


1;RET;DES 2 


1 WHEK 


I AC1 THEN BRK 


AC1.1 


= $007632 


AC2.1 


= $000000 


DC1.1 


= $0000 


DC2.1 


= $0000 


S1 .1 


= $0000 


S2 .1 


= $0000 


LSA.1 


= $0000 


CTL.1 


= $0000 


2 WHEN 


S1 AND DC1 THEN CNT,TRC 


2 WHEN 


CTL THEN BRK 


AC1.2 


= $000000 


AC2.2 


= $000000 


DC1.2 


= $40FF DC $00FF 


DC2.2 


= $0000 


S1 .2 


= $0003 DC $FFFC 


S2 .2 


= $0000 


LSA.2 


= $0000 


CTL.2 


= $0010 
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CLEAR WHEN/THEN STATEMENTS 



Command 



Result 



CES 



Clears all of the WHEN/THEN 
statements currently active. 



CES < group number > 



Clears all of the WHEN/THEN 
statements for the specified 
group. 



Comments 



The comparator values are not affected by the CES command. 
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Breaking Emulation 

The BRK action stops emulation, returning the system to pause mode. 
When a break event is detected and emulation is broken, the current CS:IP 
and event group are displayed on the terminal. Emulation begins at the 
values displayed if the registers are not altered and you run or step 
following a break. When entering emulation, the Event Monitor System 
always begins looking for events specified in group 1 . 

Breakpoints stop program execution at specific times. After a break you 
can disassemble the trace memory, look at the LSA bits in the raw trace, 
check the CPU register values, or begin stepping through your code. 

Breakpoint actions may be enabled or disabled by selecting the appropriate 
run commands. If you enter emulation with the RBK or RBV run 
commands, breakpoints are enabled. If you enter emulation with the RUN 
or RNV commands, breakpoints are disabled, even if there are event 
statements specifying the BRK action. If emulation is entered with 
breakpoints disabled, you can enable them while running by entering the 
RBK command. If you enter emulation with breakpoints enabled, you can 
disable them while running by entering the RUN command. The RNV and 
RBV commands are not allowed during emulation. These commands load 
the reset vectors, which cannot be done during emulation. 

Breaking can also be qualified by a soft switch, BKX. This switch 
determines if breaks will occur on instruction execution, or on any access 
to an address, including prefetches (see page 5-13). 

Emulation may also be halted using the STP command. The RST 
command and the reset character also break emulation. 



(continued) 
7-15 



ES1800 Emulator Reference Manual for the 80286 Microprocessor 



Examples 



Breaks when the instruction at address $3000 is executed. 



>0N BKX 
>AC1=3000 

>WHEN AC1 THEN BRK 
>RBK 
R> 



Trace only accesses between 1000 and 1 13C; break after ten accesses to this 
address range. 



>AC1=1000 to 113C 
>CTL=#10 

>WHEN AC1 THEN CNT,TRC 
>WHEN CTL THEN BRK 
>RBV 
R> 



Break when 55AA is written to I/O port A. 



>AC1='PORT_A 
>DC1=55AA 
>S1=WIO 

>WHEN AC1 AND DC1 AND S1 THEN BRK 
>RBK 
R> 
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Tracing Events 



Events: 



TRC 
TOT 



The Event Monitor System can be set up to selectively trace bus cycles. If 
all of the conditions specified in the event portion of the WHEN/THEN 
clause are satisfied, the trace action, TRC, causes the specified bus cycle to 
be recorded into the trace memory. 

The toggle trace, TOT, allows you to turn tracing on and off. When a TOT 
event is detected, the trace is toggled to the opposite state, either on or off. 
You can specify a single event that starts and stops trace each time it is 
detected or specify any number of events that toggle trace on and off. 

If there are no event actions that specify TRC or TOT, all bus cycles are 
traced. If there is a TRC event, only qualified bus cycles are traced. If 
there is a TOT event, trace is off until the TOT is detected, then all bus 
cycles are traced until encountering another TOT event. 

ITR assembles the Event Monitor System if any comparators or clauses 
have been changed. Please see PPT (page 5-27) of the ON/OFF switches. 

The Event Monitor System must be initialized via the ITR command after 
setting up the WHEN/THEN statements and event monitor registers and 
before starting the desired peek/poke cycle. 
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This table describes the trace conditions immediately before and 
immediately after a group change. 



Previous 
Group 


New Group 


Nothing 
Specified 


TRC 


TOT 


Nothing 
specified 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TRC 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT OFF 

(not tracing) 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT ON 
(tracing) 


Trace all 
cycles 


Trace only 
J qualified cycles 


No trace 
until first TOT 



This table describes initial trace conditions. 



Action Specified 


Trace Condition 


Nothing 


Trace All Cycles 


TRC 


Trace Only Qualified TRC events 


TOT 


Trace Nothing undl TOT event 
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Examples 



Trace only a specific subroutine. Break at the end of the routine. 



>AC1 = 


'Sub 


start 




>AC2= 


■Sub 


end 




>WHEN 


AC1 


THEN 


TOT 


>WHEN 


AC2 


THEN 


BRK 


>RBK 








R> 
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Counting Events 



Registers: 



Value Type - 16 bit integer 



Events: 



CTL 
CTL.1 
CTL. 2 
CTL. 3 
CTL. 4 

CTL=<EXP> 
CTL<.group>=<EXP> 



CNT 
RCT 
TOC 



Events can be defined to selectively count bus cycles. There is one 
hardware counter and there are four count registers, one register for each 
group. The hardware counter is automatically loaded with the count limit 
register for group 1 when entering run mode. 

The count, CNT, action decrements the hardware counter. When the count 
reaches zero, the CTL event becomes true. If all other conditions specified 
in the WHEN/THEN clause are satisfied, the appropriate action is taken. 

Whenever the reset count, RCT, action is specified, the count comparator 
value for the specified group is loaded into the hardware counter. When 
switching groups, the current value of the hardware counter is passed 
along as a global count value unless a RCT action is specified in the same 
list of events that causes the group switch. 

The toggle count, TOC, command allows you to turn counting on and off. 
When a TOC event is detected, the count is toggled to the opposite state, 
either on or off. You can specify an event that starts and stops the counter 
each time it is detected or specify any number of events that toggle the 
counter on and off. 
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The current value of the counter cannot be read, 
when you have reached a limit. 



You can only detect 



This table describes the count conditions immediately before and after a 
group change. 



Previous 
Group 


New Group 


Nothing 
Specified 


CNT 


TOC 


Nothing 
specified 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


CNT 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOC OFF 

(not counting) 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOCON 

(counting) 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 
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This table describes initial count conditions (always group 1). 



Action Specified 


Count Condiition 


Nothing 


No Cycles Counted 


CNT 


Count Only Qualified CNT events 


TOC 


Count Nothing until TOC event 



Examples 



Count the times that the specified data is written to a specific address. 
Break if the data is written 20 times. 



>CTL=#20 












>S1=WR 












>AC 1=4020, 


DC1 


=$XXF3 








>WHEN AC1 


AND 


DC1 AND 


S1 


THEN 


CNT 


>WHEN CTL 


THEN 


BRK 








>RBK 












R> 
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Look for a read from a specific I/O port. After it is found go to group 2, 
load the group 2 counter register value into the hardware counter, and set a 
group 2 address comparator to count every bus cycle (all addresses). Break 
after 100 bus cycles. 



>AC1='IOport 








>S1=RD 








>WHEN AC1 AND S1 


THEN 


GRO 2, 


RCT 


>CTL.2=#100 








>AC1.2=0 TO -1 








>2 WHEN AC1 THEN 


CNT 






>2 WHEN CTL THEN 


BRK 






>RBK 








R> 
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Trigger Signal 

The trigger signal is an output that is available from the BNC connector 
labelled TRIG on the back panel of the ESI 800 chassis and from pin 19 of 
the optional LSA pod. When a TGR event is detected, the trigger signal is 
asserted, and remains so for the duration of the specified bus cycle. If a 
trigger event is specified for more than one consecutive bus cycle, the 
signal stays high for the duration of the consecutive bus cycles. 

The trigger signal can be used as a pulse output for triggering other 
diagnostic equipment. It can also be used with a counter/timer for timing 
subroutines. 



Examples 



Trigger a scope when reading data from a UART. 



>AC1='DATA_P0RT 

>S1=RI0 

>WHEN AC1 AND S1 THEN TGR 



Determine the duration of a subroutine using the trigger pulse. The trigger 
pulse can be the input to a counter/timer or a scope. The duration of the 
subroutine can be determined from the pulse width displayed on the scope 
or the counter/timer readout. 



>AC1=2500 Start of subroutine 

>AC1.2=AC1+38E End of subroutine 

>DC1.2=XXXX Detect any data pattern 

>WHEN AC1 THEN TGR, GRO 2 Go to group 2 when subroutine is entered 

>2 WHEN DC1 THEN TGR Trigger during all cycles while in group 2 

>2 WHEN AC1 THEN GRO 1 Go back to group 1 when last instruction 

>RUN in subroutine is executed. 
R> 
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Special Interrupts 



Registers: 






SIA 


Value Type ■ 


32 Bit Integer 


Events: 






FSI 







The force special interrupt action, FSI, allows you to jump to a specified 
address when a specific event is detected. 

The special interrupt address register, SIA, should be set prior to entering 
the run mode if you are using the FSI event. It defines the address your 
program vectors to when the FSI is executed. 

When an FSI event is detected, an |fsi active] message is displayed on the 
screen. You may also see some unusual cycles in the trace memory at the 
address where the FSI occurred. These are internal cycles that are traced 
as the execution address is changed. These internal cycles are not purged 
from trace memory. 

The FSI event can allow you to patch to your code fast. It can also allow 
you to write soft shutdown routines for machinery that cannot be halted 
using a simple breakpoint. 

The FSI routine residing at the SIA address should terminate with an 
interrupt return (IRET) instruction. Execution resumes at the address 
immediately following the instruction that caused the FSI. If this is a soft 
shutdown, you will probably define a breakpoint at the IRET instruction. 
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Examples 



Make a patch using overlay memory 



>MAP 1000 






>AC1=8F36 






>WHEN AC1 THEN FSI 






>SIA=1000 






>ASM SI A 


Single line assembler - 


patch code 


■ 


can be assembled here. 




>RUN 






R> 







Assume the program needs to break at a certain address, but the machine 
cannot be turned off until a soft shutdown routine is executed. Set SIA to 
the address of the soft shutdown routine. Use an FSI action at the break 
address, then set a breakpoint at the end of the soft shutdown routine. 



>SIA= 


'SHUT 


down 




>AC1=! 


&7F4E2 




>AC2= 


■SHUT 


down 


+ 4E 


>WHEN 


AC1 


THEN 


FSI 


>WHEN 


AC2 


THEN 


BRK 


>RBK 








R> 
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Changing Event Groups 

The four event groups allow you to detect sequential events. When 
emulation is entered, event monitoring always begins in group 1. The 
example below describes a common use of the EMS group structure. 

You may want to trace a subroutine after it has been called by Module A or 
Module B, but not if it has been called from Modules C, D, or E. In this 
case, define the address comparators in group 1 to the address ranges of 
Modules A and B. When either of these modules is encountered, switch to 
group 2 and look for the subroutine. After tracing the subroutine, switch 
back to group 1 . Turn on the break on instruction execution (BKX) switch 
so that prefetching instructions do not trigger event actions. 



>'Module_A =1240 LEN 


246 


>'Module_B =8750 LEN 


408 


>'Sub_X =8934 LEN 56 




>ON BKX 




>ACl='Module_A 




>AC2='Module_B 




>WHE AC1 OR AC2 THE GRO 2 


>AC1.2='Sub_X 




>2 WHEN AC1 THE TRC 




>2 WHE NOT AC1 THE GRO 1 
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The TRC/TOT and CNT/TOC actions interact in a specific way when event 
groups are switched. The following state transition tables describe the 
actions taken when each of the different event combinations are specified. 



Previous 
Group 


New Group 


Nothing 
Specified 


TRC 


TOT 


Nothing 
specified 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TRC 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT OFF 

(not tracing) 


Trace all 
cycles 


Trace only 
qualified cycles 


No trace 
until first TOT 


TOT ON 

(tracing) 


Trace all 
cycles 




Trace only 
qualified cycles 


No trace 
until first TOT 



Previous 
Group 


New Group 


Nothing 
Specified 


CNT 


TOC 


Nothing 
specified 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


CNT 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOC OFF 

(not counting) 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 


TOC ON 

(counting) 


No cycles 
counted 


Count only 
qualified cycles 


No count 
until first TOC 
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List of Commands 



Command 


Description 


Page 


> 

R> 


Pause mode prompt 

Run mode prompt 

Return key 

Disassemble one instruction 

(assembler directive) 

Scroll through memory (memory mode) 

Repeat previous command line 


4-24 
4-24 


RETURN 


4-2, 4-6 






RETURN 


6-49 






I RETURN 


4-25 6-60 


/ 


4-2,4-6, 



CTRLQ 
CTRLR 
CTRLS 
CTRLX 
CTRLZ 



Statement separator 

Repeat command 

Start screen scrolling (can be changed) 

Reprint current line 

Stop screen scrolling (can be changed) 

Delete line 

Reset the emulator (can be changed) 



5-113 

4-6 

4-6,5-110 

4-29 

4-6,4-29 

4-29 

4-6,4-29 

4-29 
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Command 


Description 


Page 


ESC ESC 


Escape transparent mode 
(can be changed) 


4-29, 5-41 


$ 


Hexadecimal 


4-12 


$ 


Current offset address 
(assembler directive) 


6-49 


# 


Decimal 


4-12 


% 


Binary 


4-12 


\ 


Octal 


4-12 


= 


Equals 


4-3 





Parentheses 


4-8,4-13 


@ 


Indirection 


4-9,4-13, 
4-18 


* 


Multiplication 


4-17 


1 


Division 


4-17 


+ 


Addition 


4-5,4-17 


- 


Subtraction 


4-5,4-17 


- 


Negation 


4-18 


& 


Bitwise AND 


4-5,4-17 


A 


Bitwise OR 


4-5,4-17 


« 


Shift left 


4-5,4-17 


» 


Shift right 


4-5,4-17 


• 


Inverse, bitwise NOT 


4-17,4-18 


• 
• 


Segment/offset operator or selector 


4-9 
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Command 



Description 



Page 






Address expression or memory 

attribute specifier 

Increment Memory Mode address 

Execute macro #2 

Decrement Memory Mode address 

Execute macro #1 

Help menu 

Error query 

Define/execute macro 

Symbol definition (single quote) 



4-9,4-10 

6-52, 6-60 

4-2,4-6 

6-52, 6-60 

4-2, 4-6 

4-2,4-6, 
4-20 

4-6 

5-107 

4-9, 5-120, 
5-121,6-48 



ABS 
AC1, AC2 

ADF 
ADT 
AND 

ASM 

AX, AH, AL 



Absolute value 

Address comparators 1 and 2 (registers) 

Force address register 
Assemble descriptor table 
Logical event AND 

Line assembler 



4-17,4-18 

5-77, 7-3, 
7-10 

5-74 

6-13 

4-15,4-16, 
7-10 

6-44 



Accumulator (word, high byte, low byte) 5-75 



BAS 



Set/display base value 



5-83 
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Command 



BKX 

BMO 

BP 

BRK 

BTE 

BUS 

BX, BH, BL 

BYM 

BYT 



Description 



Break on instruction execution switch 



Page 



5-13,7-15, 
7-27 



Block move 6-39 

Base pointer (register) 5-75 

Break 7-15 

Bus (RDY) timeout enable switch 5-14 

Display status of lines 6-89 
Base register (word, high byte, low byte) 5-75 

Byte mode 4-26 

Byte access status 7-6 



CCT 

CEE 

CES 

CK 

CLK 

CLM 

CLR 

CMC 

CNT 



Computer port control 

Coprocessor error enable switch 

Clear WHEN/THEN statements 

Internal/external clock selection switch 

Read target system clock 

Clear memory map 

Clear microprocessor data registers 

Clear macros 

Count event 



COM Establish communication with target 

CPY Copy data to both ports switch 

CRC/CRE/CRO Target cyclic redundancy check 

CS Code segment register 

CSA Code segment access rights register 



5-44 

5-16 

7-14 

5-17 

6-87 

5-70 

5-78 

5-109 

7-9, 7-20, 
7-28 

5-56 

5-18 

6-88 

5-75 
5-75 
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Command 


Description 


Page 


CSB 


Code segment base register 


5-75 


CSEG 


Set code segment window 
(assembler directive) 


6-46 


CSL 


Code segment limit register 


5-75 


CTL 


Count limit register 


5-77, 7-9, 
7-20 


CX, CH, CL 


Count register (word, high byte, low byte) 5-75 


DB 


Display memory block 


6-33 


DB 


Define constant byte data 
(assembler directive) 


6-47 


DBE 


Descriptor table break enable switch 


5-19 


DC 


Don't care 


4-9, 7-6 


DC1,DC2 


Data comparators 1 and 2 (registers) 


5-77 


DDT 


Disassemble descriptor table 


6-15 


DEL 


Delete symbol/section 


5-123 


DES 


Display WHEN/THEN statements 


7-12 


DFB 


Set/display default base value 


5-88 


DFB 


Default base register 


5-76 


DI 


Destination index register 


5-75 


DIA 


Display ASCII character string 


5-60 


DIS 


Display disassembled memory 


6-50 


DM 


Display memory map 


5-63 


DMD 


Display modes being used 
by Emulator and processor 


4-26 


DML 


Display virtual memory mapping log 


5-64 


DNL 


Download 


5-46 
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Command 



Description 



Page 



DR 

DRL 

DRT 

DS 

DSA 

DSB 

DSL 

DT 

DTB 

DTF 

DW 



DX, DH, DL 



Display microprocessor registers 

Display/load MMU registers 

Display raw trace memory 

Data segment register 

Data segment access rights register 

Data segment base 

Data segment limit register 

Disassemble trace memory 

Disassemble trace memory backward 

Disassemble trace memory forward 

Define constant word data 

(assembler directive) 

Data register (word, high byte, low byte) 



5-78 

5-81 

5-96 

5-75 

5-75 

5-75 

5-75 

5-100 

5-104 

5-104 

6-47 

5-75 



END 

ENI 
EQU 

ES 
ESA 
ESB 
ESL 



Line assembler exit 

Enable interrupts (switch) 
Define/redefine local symbol 
(assembler directive) 
Extra segment register 
Extra segment access register 
Extra segment base register 
Extra segment limit register 



4-25, 6-44, 
6-46 

5-21 

6-47 

5-75 
5-75 
5-75 
5-75 



FAR 



Outside current segment 
(assembler directive) 



6-49 
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Command 



Description 



Page 



FIL 

FIN 

FLX 

FSI 

FSX 



GDO-7 

GDB 

GDL 

GRO-7 

GRO 

HLT 
HSD 

IAK 
IDA 

IDB 

IDL 

IDX 

IEE 

IF 

IHE 



Fill memory with data pattern 

Find data pattern 

Flags register 

Force special interrupt 

Force special interrupt on instruction 

execution switch 

General purpose data registers (0-7) 
Global descriptor table base register 
Global descriptor table limit register 
General purpose range registers (0-7) 
Event monitor system group 

Halt status 

Halt or shutdown status 

Interrupt acknowledge status 

Interrupt descriptor table 

access rights register 

Interrupt descriptor table base register 

Interrupt descriptor table limit register 

Repeat index register 

Interrupt error enable (switch) 

Instruction fetch status 

Ignore halt errors 



6-37 
6-35 

5-76 
7-25 
5-22 



5- 


-76, 


5- 


-90 


5- 


-75 






5- 


-75 






5- 


-76, 


5- 


-92 


7- 


-11 






6- 


-89 






5- 


-98, 


7- 


-6 


5- 


-98, 


7- 


-6 


5- 


-75 






5- 


-75 






5- 


-75 






5- 


-111 


r 




5- 


-23 






5- 


■98, 


7- 


-6 


5- 


■24 
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Command 


Description 


Page 


ILG 


Illegal memory access attribute 


5-67 


IM 


Introspective mode (switch) 


5-25 


IOA 


IO access status 


7-6 


IOP 


IO mode pointer register 


5-75, 5-76, 
5-87 


IOP 


Display value of IOP 


6-61 


IP 


Instruction pointer register 


5-75 


IRA 


Internal range 


4-18, 7-3 


ITR 


Initialize trace 


7-17 



LO-9 

LD 
LDA 

LDB 

LDL 

LDT 

LDV 

LEN 

LIM 

LOK 

LOV 

LSA 

LST 



Print value of local symbol 

(assembler directive) 

Load EEPROM data 

Local descriptor table 

access rights register 

Local descriptor table base register 

Local descriptor table limit register 

Local descriptor table register 

Load vectors 

Length (specifies range) 

Repeat limit register 

Locked bus cycle status 

Load overlay memory 

Logic State Probe comparator (register) 

Decrement address in memory mode 



6-47 



5- 


■8,5 


-34 


5- 


■75 




5- 


■75 




5- 


-75 




5- 


-75 




5- 


-78, 


6-25 


4- 


-12 




5- 


-111 




7- 


-6 




5- 


-71, 


6-41 


5- 


-77 




6- 


-52, 


6-60 
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Command 



Description 



Page 



M 


Enter memory mode 


6-52, 6-54 


MAC 


Display macros 


5-106 


MAP 


Define overlay memory map 


5-66 


MEM 


Memory access status 


7-6 


MIO 


Enter I/O mode 


6-57 


MMP 


Memory mode pointer register 


5-76 


MMP 


Display value of MMP 


5-85, 6-62 


MOD 


Modulo 


4-5,4-17 


MSW 


Machine status word register 


5-75 


NBC 


No bus cycles status 


5-98 


NEAR 


Within current segment 
(assembler directive) 


6-49 


NMI 


NMI cycle status 


7-6 


NOT 


Logical event NOT 


4-15,7-10 


NXT 


Increment address in memory mode 


6-52, 6-60 


OFF 


Display/disable switches 


5-1,5-9 


ON 


Display/enables switches 


5-1,5-9 


OR 


Logical event OR 


4-15,4-16 


ORG 


Set offset into code segment 
window (assembler directive) 


6-46 


OVL 


Overlay memory access status 


7-6 


OVS 


Set overlay speed 


5-73 



PEA 



Processor extension acknowledge status 7-6 
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Command 


Description 


Page 


PEN 


Pause mode protection enable switch 


5-26 


PHY 


Physical address mode 


6-4,6-12 


PPT 


Trace peek and poke cycles switch 


5-27 


PRE 


Preview mode (assembler directive) 


6-47 


PTV 


Convert physical address to virtual 


6-10 


PUR 


Clear symbolic memory 


5-125 


QF 


Queue flush cycle status 


7-6 


RBK 


Run with breakpoints 


6-18,6-21, 
7-15 


RBV 


Load vectors and run with breakpoints 


6-18,6-21, 
7-15 


RCT 


Reset count limit 


7-20 


RD 


Read cycle status 


7-6 


RDY 


Ready switch 


5-29 


RET 


Display return and line feed 


5-127 


REV 


Display software revisions 


5-126 


RIO 


Read I/O status 


5-98, 7-6 


RM 


Read memory status 


5-98, 7-6 


RMS 


Real mode select switch 


5-31 


RNV 


Run with new vectors 


6-18,6-21, 
7-15 


RO 


Read only attribute 


5-67 


RST 


Reset pod microprocessor 


6-29, 7-15 


RUN 


Run emulation 


6-18,6-21, 

7-15 


RW 


Read/write attribute 


5-66 
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SI, S2 Status comparators 1 and 2 (registers) 5-77 

SAV Save EEPROM data 5-8, 5-36 

SEC Display section 5-21 

SET Set/display system parameters 5-1,5-3 

SF Display special function menu 6-66 

SF 0-3 RAM Tests 6-67, 6-73 

SF4-12 Special functions (memory) 6-74,6-85 

SF 13 Special functions (Emulator) 6-86 

SF 24-32 Special functions (I/O) 6-76, 6-85 

SI Source index register 5-76 

SIA Special interrupt address register 5-77 

selector:offset (virtual mode) 

SIA Special interrupt address 5-77 

register (real mode) 



SLO 


Slow interrupt enable switch 


5-32 


SP 


Stack pointer register 


5-75 


ss 


Stack segment register 


5-76 


SSA 


Stack segment access register 


5-76 


SSB 


Stack segment base register 


5-76 


SSL 


Stack segment limit register 


5-76 


STI 


Step through interrupts switch 


5-33 


STP 


Step and stop 


6-24, 7-15 


SYM 


Display symbols 


5-119 



TA Task access rights register 5-76 
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Command 



Description 



Page 



TAR 


Target access status 


7-6 


TB 


Task base register 


5-76 


TCT 


Terminal port control 


5-43 


TGR 


Enable trigger output 


7-24 


TGT 


Target memory attribute 


5-67 


THE 


THEN used in event statements 


4-4,7-2 


TL 


Task limit register 


5-76 


TO 


To 


4-12 


TOC 


Toggle counting 


7-20, 7-28 


TOT 


Toggle trace memory 


7-17,7-28 


TR 


Task register 


5-76 


TRA 


Transparent mode 


5-41 


TRC 


Trace event 


7-17,7-28 


TST 


Test register for repeats 


5-94 


UPL 


Upload serial data 


5-52 


UPS 


Upload symbols 


5-54 


VBL 


Verify block data 


6-38 


VBM 


Verify block move 


6-40 


VFO 


Verify overlay against target 


5-72, 6-42 


VFY 


Verify serial data 


5-51 


VIR 


Virtual address mode 


6-4,6-17 


VTP 


Convert virtual address to physical 


6-11 



A-12 



Appendix A: ES Language Mnemonics 



Command 
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WAI 


Wait until emulation is broken 


6-27 


WDM 


Word mode 


4-26 


WHEN/THEN 


WHEN/THEN Statements 


7-1,7-2 


WIO 


Write IO status 


5-98, 7-6 


WM 


Write memory status 


5-98, 7-6 


WR 


Write cycle status 


7-6 


WRD 


Word access status 


7-6 


X 


Don't care 




X 


Exit memory or I/O mode 


4-25, 6-59 


X 


Exit line assembler 


4-25, 6-44, 




(assembler directive) 


6-46 


XRA 


External range 


7-3 
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ERROR MESSAGES 

The following messages are displayed when the Emulator or target 
hardware is not functioning properly or when a software problem requires 
attention. 

Messages followed by an asterisk (*) are Emulator hardware related. 

Messages followed by two asterisks (**) are target hardware related. 

Messages followed by three asterisks (***) are software related. 

Using an oscilloscope, verify that the reset line is in fact being held reset. 
Some operating systems normally hold the microprocessor reset until 
needed. If the reset line is not being held active at the probe tip, then 
disconnect the target verify the condition using the null target mode. 



BUSY ASSERTED > 
.5 SEC** 



BUS TIMEOUT 
ERROR > 1 SEC** 



Indicates a possible problem with the 
associated line and that the Emulator has 
detected this line being asserted for greater 
than .5 seconds. 

This indicates a RDY was not returned to 
the CPU within 1 second. Please see the 
BTE command on the ON/OFF menu. 
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DESCRIPTOR 
TABLE INVALID*** 



DESCRIPTOR 

TABLE 

MODIFIED*** 



HANDSHAKE 
ERROR* 



HOLD 

ACKNOWLEDGE 

ASSERTED** 



INTR ASSERTED > 
.5 SEC** 



This indicates that the Emulator has been 
unable to access a valid descriptor table in 
the target system memory. This access must 
be done each time the Emulator converts 
between a virtual and physical address. 

The Emulator has detected a write to one of 
the target system's descriptor tables. (The 
DTA soft switch must be ON to enable this 
message.) 

This is an internal Emulator diagnostic 
error. Type CTRL Z to clear the error. If it 
persists, call the factory. 

Displays when a hold acknowledge is 
asserted for longer than .5 seconds. It is 
removed when the microprocessor regains 
control of the bus. This message is related 
to two environments: when a DMA 
controller takes over the bus by asserting 
the hold line, and when a microprocessor is 
running in a multiprocessor environment. 
This message is generally not due to an 
error, but is a statement of what the 
processor is doing. 

This indicates a possible problem with the 
interrupt line, which the Emulator has seen 
asserted for .5 seconds. 



MEMORY ACCESS 
VIOLATION*** 



If the target program attempts to access an 
area of target that is mapped as illegal 
(ILG), this error occurs. DM helps find 
areas mapped as illegal. DRT helps find 
where the program was making access. 
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MEMORY WRITE 
VIOLATION*** 



If the program attempts to write to the 
overlay memory in an area that is mapped 
read only, an error occurs. Using the DM 
command and the raw trace (DRT) to look 
for write cycles helps troubleshoot this 
problem. DM helps determine areas 
mapped as read only. DRT helps find 
where the program performed the write. 



NO BUS CYCLES* 



No ALEs were detected for at least 1.0 ms 
and no other fault conditions such as a 
halted, waiting, or reset microprocessor 
were found. Displays when a reset (power- 
up, CTRL Z or RST) is executed from the 
Emulator controller and no 
acknowledgment from the Emulator board 
is received. This situation is due to a pod, 
Emulator, or controller board problem. 
Possible solutions are reseating boards, 
reseating pod cables and cycling power. 



NO CLOCK** 



This indicates the microprocessor clock 
frequency is less than 2 MHz. 

At power-up, if there is no clock from the 
target, you are given the option of selecting 
an internal clock. If an external clock is 
selected, and the NO CLOCK message 
displays, you must use CTRL Z to either 
choose an internal clock or correct the 
problem with the external clock. 



NO TARGET 
POWER** 



This displays when the +5V supply in the 
target system is at approximately +4V or 
less. 
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PEREQ SIGNAL 
ASSERTED > .5 
SEC** 



Indicates a possible problem with the 
associated line and that the Emulator has 
detected this line being asserted for greater 
than .5 seconds. 



POD CPU NOT 
INITIALIZED* 



POD CPU NOT 
RESPONDING* 



PROCESSOR 
HALTED** 



When a reset occurs (power-up, CTRL Z or 
RST), the controller and Emulator begin an 
initialization routine to establish 
communication. If the initialization routine 
does not complete, the POD CPU NOT 
INITIALIZED message is displayed. This 
is a pod, Emulator, or controller board 
problem. Possible solutions are reseating 
boards, reseating pod cables and cycling 
power and verifying that the 
microprocessor is correctly installed in the 
pod. 

When a command is executed, the ES 
language software looks to see if the 
command has completed. If it has not, then 
the software checks to see if the 
microprocessor is still running or if there is 
an error condition. If an error condition 
exists, then the appropriate message is 
displayed. However, if the microprocessor 
is still running, and no error conditions 
exist, then POD CPU NOT RESPONDING 
is displayed. A possible solution is to 
execute a CTRL Z followed by repeating 
the command. As a last resort, try cycling 
the power. 

This indicates that a halt (HLT) instruction 
has been executed and that the 
microprocessor has remained in this state 
for more than .5 seconds. The 

microprocessor is still in a run state and 
commands can still be entered. 
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PROCESSOR 
SHUTDOWN** 



PROCESSOR 
WAITING** 



This indicates that the Emulator has 
detected an Intel specified shutdown 
Condition on the CPU status pins. 

This means that the microprocessor is 
waiting for a ready to be returned to it. 
This is displayed only if the microprocessor 
has been waiting for more than .5 seconds. 
When the condition is corrected, the 
message is removed. 

NOTE 1: You must use the target ready 
when overlaying dynamic RAM that uses 
the ready line to halt microprocessor 
activity during refresh cycles. When a 
refresh cycle occurs on many systems the 
ready line is held in the not ready state until 
refresh is complete. If an internal ready is 
used for dynamic RAM, then the 
microprocessor completes its present bus 
cycle before the refresh is complete and 
either writes bad data or reads bad data. 
The choice of internal or external ready 
while using overlay memory is made by 
using the RDY soft switch. 

NOTE 2: When overlaying nonexistent code 
space it is necessary to use the internal 
RDY. Users may want to overlay 
nonexistent (meaning an area that is not 
decoded in their hardware) to patch in code 
to correct software bugs. 

NOTE 3: When selecting internal or 
external RDY for areas overlaid, it is 
selecting that particular RDY for all 
overlay. 
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RESET ASSERTED** This indicates that a reset from the target 

has been asserted for more than .5 seconds. 
When this error message is displayed, 
system operation may be continued. If the 
error situation persists and another 
command is executed, the error is displayed 
again. 

Using an oscilloscope, verify that the reset 
line is in fact being held reset. Some 
operating systems normally hold the 
microprocessor reset until needed. If the 
reset line is not being held active at the 
probe tip, then disconnect the target and 
verify the condition using the null target 
mode. 

TARGET SOFTWARE ERRORS: PROTECTION VIOLATION 

If the soft switch disabling protection is not asserted, the firmware 
provides a variety of protection checks for each memory or I/O access 
requested. If any of these checks fail, an error is flagged to the controller. 

Protection violation errors appear in the format illustrated below: 



PROTECTION VIOLATION: <message> 



PRESENT Checks that the requested segment resides 

in physical memory. 

DPL < CPL Checks that current privilege level is less 

than or equal to segments DPL, 

SEGMENT NOT (Peek) checks that segment is readable. 

READABLE 
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SEGMENT NOT 
WRITABLE 



(Poke) checks that segment is writable. 



WRITE TO 

EXECUTABLE 

SEGMENT 



(Run/step) checks that segment is 
executable. 



INVALID SEGMENT 
DESCRIPTOR 



Checks that descriptor refers to a segment. 



I/O PL 



Checks that current privilege level (CPL) is 
less than or equal to the I/O privilege level. 



OFFSET > LIMIT 



Checks that requested offset is less than or 
equal to limit. 
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SERIAL DATA FORMATS 



In order to download a program into target memory, the ESI 800 needs 
some way to receive this data in an intelligible format. This Appendix 
describes the downloading formats which the ESI 800 understands. 
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MOS Technology Format 



Figure 10. Specifications for MOS Technology Data Files Copyright 1983, 
Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



B 
C 



A 
A 
A 
A 



START CHARACTER 



BC - Byte Count. The hexadecimal number of data 
bytes in the record 



AAAA - Address of first data byte in record. AAAA 
in hexadecimal notation only 



HH - One data byte in hexadecimal notation 



CCCC - Checksum. Two byte binary summation of 
preceding bytes in record (including address, and 
data bytes) in hexadecimal notation. 

This space can be used for line feed, carriage return or 
comments. 

(Beginning of next record) 



LEGEND 

= Start Character 
BC - Byte Count (BC > 00 in Record, BC - End of File Record) 

AAAA - Address Field 
CCCC - Checksum of Record 
RRRR = Record Count 
HH - Two Hexadecimal Digits (0:9, A:D) 



END-OF-FILE RECORD 



B 
C 



C 
C 
C 
C 



START CHARACTER 

Byte Count. BC - 00 in End of File Record 

Recoid Count 
Checksum 



OUTPUT 



NOTES 



1 j Number of bytes per record is variable See Table 3. 1 
2) Each line ends, with nonprinting line feed, carriage return 
and nulls. 



2 Hex Characters - 1 byte 



^ 



Data Records 



BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCC 
BCRRRRCCCC 



? 
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Motorola Exorcisor Format 



Figure 11. Specifications for Motorola Exorciser/16-BM Data Files/ 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



SIGN ON RECORD OPTIONAL 



B 
C 



START CHARACTERS 



BC - Byte Count. The number of data bytes plus 3 (1 for 
checksum and 2 for address) in hexadecimal notation 



AAAA - Address of first date byte in record. AAAA in 
hexadecimal notation only 



HH - One data byte in hexadecimal notation 



SO Start characters of sign on record. Except 
for start characters SO record has same format as 
data record 



END OF FILE RECORD 



C 
C 



A 
A 
A 
A 



C 
C 



CC - Checksum. One's complement of binary summation 
of preceding bytes in record (including byte count, 
address and data bytes) in hexadecimal notation f 

This space can be used for line feed, carriage return or 
comments 



START CHARACTERS 



Byte Count. BC - 03 in End of File Record 



Address 



Checksum 



(Beginning of next record) 



LEGEND 

SO 

S1 
BC 

AAAA 

HH 

CC 



Optional Record Start Characters 

Start Characters 

Byte Count 

[(Date Butes/Record + 3] 

Address of First Data Byte 

Two Hexadecimal Digits (0-9, A-F) 

Checksum of Record (one byte) 



OUTPUT 



NOTES 



1 ) Number of bytes per record is variable. See Table 3.1 . 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 

3) Sign on record may precede data 



2 Hex characters 1 byte 



H 



Data Records 



SIBCAA/WHHHHHHHHHHHHHHHHHhHHHHHHHHHHHHHHCC 
S1BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC 
S1BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC 
S1BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC 
S1BCAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC 
S9BCAAAACC 



} 
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Intel Intellec Format 



Figure 12. Specifications for Intel Intellec/8/MDS Data Files/ 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



END OF FILE RECORD 



B 
C 



A 
A 
A 
A 



START CHARACTER 

BC - Byte Count. The hexadecimal number of data bytes 
in the record 



AAAA - Address of first date byte in record. AAAA in 
hexadecimal notation only 



TT - Record Type (00) 

HH - One data byte in hexadecimal notation 



CC - Checksum. Negation (two's complement) of binary 
summation of preceding bytes in record (including byte 
count, address, and data bytes) in hexadecimal notation 

This space can be used for line feed, carriage return or 
comments 



STAR"" CHARACTER 

Byte Count. BC - 00 in End of File Record 

Address 

TT Record Type (01) 



r r 



LEGEND 








_ 


Start Characters 




BC 


- 


Byte Count (Date Bytes/Record) 


AAAA 


- 


Address Field 




TT 


- 


Record Type 




H 


- 


One Hexadecimal Digit (0-9, 


A-F) 


CC 


- 


Checksum of Record 





OUTPUT 



NOTES 



1 ) Number of byteis per record is variable. See Table 3.1 . 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 



2 Hex characters 1 byte 



\ 



Data Records 



BCAAAATTHHHHHH HHHHHHHHHHHHHHHHHHHHHHHHHHCC j 
BCAAAATTHHHHHH HHHHHHHHHHHHHHHHHHHHHHHHHHCC > 
BCAAAATTHHHHHH HHHHHHHHHHHHHHHHHHHHHHHHHHCC J 
BCAAAATT 
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Signetics/Absolute Object File Format 



Figure 13. Specifications for Signetics/Absolute Object Data Files 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



END OF RLE RECORD 



A 
A 
A 
A 



B 
C 



A 
C 



START CHARACTER 



AAAA - Address of first date byte in record. AAAA in 
hexadecimal notation only 



BC - Byte Count. The hexadecimal number of data bytes 
in the record 

AC - Address Check. Every byte is exclusive Red with 
the previous byte, then rotated left one bit. 



HH - One data byte in hexadecimal notation 



START CHARACTER 



Address 



Byte Count. BC - 00 in End of File Record 



D 
C 



DC - Data Check. Every byte is exclusive O Red with the 
previous byte, then rotated left one bit. 

.This space can be used for line feed, carriage return or 
comments 

.(Beginning of next record) 



LEGEND 

- Start Characters 
AAAA - Address Field 
BC - Byte Count (Date Bytes/Record) 

AC - Address Check. Checksum of address and byte count 

HH - Two Hexadecimal Digits (0-9, A-F) 

DC - Data Check. Checksum of data in record 



OUTPUT 



NOTES 



1 ) Number of bytes per record is variable. See Table 3. 1 . 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 



2 HEX characters 1 byte 



7 



Data Records 



AAAABCACHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC 1 1 
AAAABCACHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC > 
AAAABCACHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCcJ 
AAAABCAC 
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Tektronix Hexadecimal Format 



Figure 14. Specifications for Tektronix Hexadecimal Data Files 
Copyright 1983, Data I/O Corporation; reprinted by permission. 



INPUT 

DATA RECORD 



/ 



A 
A 
A 
A 



B 
C 



C 
C 




/ - Start Character 



AAAA - Address of first date byte in record, 
(hexadecimal notation) 



BC - Byte Count. The hexadecimal number of data bytes 
in the record 

CC - Checksum. Eight bit sum of the four bit 
hexadecimal values of the six digits that make up the 
address and byte counts (hexadecimal notation) 



One data byte in hexadecimal notation 



CC - Checksum. Eight bit sum modula 256, of the four 
bit hexadecimal values of the digits that make up the 
data bytes. 

Carriage Return 

(Beginning of next record) 



OUTPUT 

NOTES 

1 ) Number of bytes per record is variable. See Table 3.1 . 

2) Each line ends with nonprinting line feed, carriage return 
and nulls 



C 
C 



2 Hex characters 1 byte 



~\ 



Data Records 



/AAAABCCCHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC I 
/AAAABCCCHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC > 
/AAAABCCCHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCC) 
/AAAABCCC ^^___ 

, End ol File Record 
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ABORT RECORD 



// -Two Start Characters 



XX. X - Arbitrary string of ASCII characters 



Carnage Return 



END OF FILE RECORD 



C 
C 



START CHARACTER 



AAAA Transfer Address 



Byte Count. BC - 00 in End of File Record 

CC - Checksum. Eight bit sum of the four bit 
hexadecimal values of the six digits that make up 
the transfer address and the byte count 
(hexadecimal notation) 

Carriage return 



LEGEND 

- Start Characters 
AAAA - Address Field 

BC - Byte Count (Date Bytes/Record) 

CC - Checksum of Record 

HH - Twc Hexadecimal Digits (0-9, A-F) 

X - Any ASCII Character 
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Extended Tekhex Format 

Copyright 1983, Tektronix; reprinted by permission 
Extended Tekhex uses three types of message blocks: 

1 . The data block contains the object code. 

2. The symbol block that contains information about a 
program section and the symbols associated with it. This 
information is only needed for symbolic debug. 

3. The termination block contains the transfer address and 
marks the end of the load module. 

NOTE 

Extended Tekhex has no specially defined abort block. 
To abort a formatted transfer, use a Standard Tekhex 
abort block. 

Each block begins with a six-character header field and ends with an end- 
of-line character sequence. A block can be up to 255 characters long, not 
counting the end-of-line character. The header field has the format 
shown in the following table. 
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NUMBER 






OF ASCII 




ITEM 


CHARACTERS 


DESCRIPTION 


% 


1 


A permit sign specified that the block is 
in Extended Tekhex format. 


Block 


2 


The number of characters in the block: a 


Length 




two-digit hex number. This count does not 
include the leading % or the end-of-line. 


Block 


1 


6 = data block 


Type 




3 = symbol block 

8 = termination block 


Checksum 


2 


A two-digit hex number representing the 
sum, mod 256, of l:he values of all the 
characters in the block, except the leading 
%, the checksum digits, and the end-of-line. 
The following table gives the values for 
all characters that may appear in Extended 
Tekhex message blocks. 



Character Values for Checksum 


Computation 


CHARACTERS 


VALUES (DECIMAL) 


0..9 


0..9 


A..Z 


10. .35 


$ 


36 


% 


37 


. (period) 


38 


(underscore) 


39 


a..z 


40-65 
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VARIABLE- LENGTH FIELDS 

In Extended Tekhex, certain fields may vary in length from 2 to 17 
characters. This practice enables you to compress your data by eliminating 
leading zeros from numbers and trailing spaces from symbols. The first 
character of a variable-length field is a hexadecimal digit that indicates the 
length of the rest of the field. The digit indicates a length of 16 
characters. 

For example, the symbols START, LOOP, and KLUDGESTARTSHERE 
are represented as 5START, 4LOOP, and OKLUDGESTARTSHERE. The 
values 0, 100H, and FF0000H are represented as 10, 3100, and 6FF0000. 

DATA AND TERMINATION BLOCKS 

If you do not intend to transfer program symbols with your object code, 
you do not need symbol blocks. Your load module can consist of one or 
more data blocks followed by a termination block. The following table 
gives the format of a data block and a termination block. 



Extended Tekhex Data Block Format 

# OF ASCII 
ITEM CHARACTERS DESCRIPTION 

Header 6 Standard header field 

Block Type - 6 

Load Address 2 to 17 The address where the object code is to be 

loaded: a variable- length number. 

Object 2n n bytes, each represented as two hex 

digits. 
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Extended Tekhex Termination 


Block 


Header 6 


Standard header field 




Block type = 8. 


Transfer Address 2 to 17 


The address where program execution is to 




begin: a variable- length number. 



SYMBOL BLOCKS 

A symbol used in symbolic debug has the following attributes: 

1. The symbol itself: 1 to 16 letters, digits, dollar signs, 
periods, a percent sign, or symbolize a section name. 
Lower case letters are converted to upper case when they 
are placed in the symbol table. 

2. A value: up to 64 bits (16 hexadecimal digits). 

3. A type: address or scalar. (A scalar is any number that is 
not an address.) An address may be further classified as a 
code address (the address of an instruction) or a data 
address (the address of a data item). As symbolic debug 
does not currently use the code/data distinction, the 
address/scalar distinction is sufficient for standard 
applications of Extended Tekhex. 

4. A global/local designation. This designation is of limited 
use in a load module, and is provided for future 
development. If the global/local distinction is not 
important for your purposes, simply call all your symbols 
global. 

5. Section membership. A section may be thought of as a 
named area of memory. Each address in your program 
belongs to exactly one section. A scalar belongs to no 
section. 

The symbols in your program are conveyed in symbol blocks. Each symbol 
block contains the name of a section and a list of the symbols that belong to 
that section. (You may include scalars with any section you like.) More 
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than one block may contain symbols for the same section. For each 
section, exactly one symbol block should contain a section definition field, 
which defines the starting address and length of the section. 

If you object code has been generated by an assembler or compiler that 
does not deal with sections, simply define one section called, for example, 
MEMORY, with a starting address of and a length greater than the 
highest address used by your program; and put all your symbols in that 
section. 

The following table gives the format of a symbol block. Tables that follow 
give the formats for section definition fields and symbol definition fields, 
which are parts of a symbol block. 



Extended Tekhex Symbol Block Format 



ITEM 
Header 



Section Name 



Section 
Definition 



NUMBER 

OF ASCII 

CHARACTERS 

6 



2 to 17 



5 to 35 



Symbol 



5 to 35 



DESCRIPTION 

Standard header field 

Block Type » 3 

The name of the section that contains the 
symbols defined in this block: a 
variable- length symbol. 

This field must be present in exactly one 
symbol block for each section. This field 
may be preceded or followed by any number 
of symbol definition fields. The table on 
the next page gives the format for this 
field. 

Zero or more symbol definition fields as 
described in the next table. 
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Extended 


Tekhex Symbol Block: 


Section Definition Field 


ITEM 



NUMBER 

OF ASCII 

CHARACTERS 

1 


DESCRIPTION 

A zero signals a section definition field. 


Base 


2 to 17 


The starting address of the Address 
section: a variable- length number. 


Length 


2 to 17 


The length of the section: a variable- length 
number, computed as 1 + (high address base 
address). 



Extended 


Tekhex Symbol Block: 

NUMBER 
OF ASCII 


Symbol Definition Field 


ITEM 


CHARACTERS 


DESCRIPTION 


Type 


1 


A hex digit that indicates the global/local 
designation of the; symbol, and the type of 
value the symbol represents: 

1 = global address 

2 = global scalar 

3 = global code address 

4 = global data address 

5 - local address 

6 = local scalar 

7 = local code address 

8 = local data address 


Symbol 


2 to 17 


A variable- length symbol. 


Value 


2 to 17 


The value associated with the symbol: a 
variable- length number. 



The following figures show how the preceding tables of information might 
be encoded in Extended Tekhex. The information for the Extended 
Tekhex Symbol Block illustration could be encoded in a single 96- 
character block. It is divided into two blocks for purposes of illustration. 
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Figure 13. Extended Tekhex Data Block 



Block length: 15H = 21 

Checksum: 1CH = 28 = 1 +5+6+3+1 +0+0+0+2+0+2+. 
■ Object Code: 6 bytes 



rh rh 



I 



%1561C3100020202020202 



! 



Load address: 1 00H 
Block type: 6 
Header character 



Figure 14. Extended Tekhex Termination Block 



\ 



Block length: 8 

Checksum: 1AH = 26 = 0+8+8+2+8+0 



%0881A280 



\ 



Transfer address: 80H 
Block type: 8 
Header character 
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Figure 15. Extended Tekhex Symbol Block 



Block length: 37H = 55 

Checksum: 60H = (3+7+3+8+28+31 +12+28+29+...)mod 256 



r^ rh 



I 



Section definition field: 

base address = 40H; length = C6H 



%373608SVCSTUFF02402C622CRlD14OPEN25014READ25815WRITE260 

%373C88SVCSTUFF15CLOSE26814EXIT27029BUFLENGTH28013BUF278 

i , i 



t. 



Section name: 
Block type: 3 
Header character 
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Motorola S-Record Format 

S- RECORD CONTENT 

When viewed by the user, S- records are essentially character strings made 
of several fields which identify the record type, record length, memory 
address, code/data,, and checksum. Each type of binary data is encoded as 
a 2-character hexadecimal number: the first character representing the 
high-order 4 bits, and the second the low-order 4 bits of the byte. 

The 5 fields which comprise an S-record are: type, length, address, 
code/data and checksum. 

The fields are composed as follows: 



FIELD 

type 

record length 

address 

code/data 



PRINTABLE 
CHARACTERS 

2 

2 

4, 6, or 8 

0-2n 



checksum 



CONTENTS 

s-record type -- SO, S1, etc. 

The count of the character pairs in the 
record, excluding the type and record length. 

The 2-, 3-, or 4 -byte address at or which the 
data field is to be loaded into memory. 

From to n bytes of executable code, memory- 
loadable data, or descriptive information. 
For compatibility with teletypewriters, some 
programs may limit the number of bytes to as 
few as 28 (56 printable characters in S- 
record). 

The least significant byte of the one's 
complement of the sum of the values 
represented by the pairs of characters making 
up the record length, address, and the 
code/data fields. 



Each record may be terminated with a CR/LF/NULL. Additionally, an S- 
record may have an initial field to accommodate other data such as line 
numbers generated by some time-sharing systems. 
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Accuracy of transmission is ensured by the record length (byte count) and 
checksum fields. 

S- RECORD TYPES 

Eight types of S-records have been defined to accommodate the several 
needs of the encoding, transportation, and decoding functions. The 
various Motorola upload, download, and other file-creating or debugging 
programs, utilize only those S-records which serve the purpose of the 
program. For specific information on which S- records are supported by a 
particular program, the user's manual for that program must be consulted. 

An S-record format module may contain S-records of the following types: 

50 The header record for each block of S-records. The 
code/data field may contain any descriptive 
information identifying the following block of S0- 
records. Under VERSAdos, the resident linker's 
IDENT command can be used to designate module 
name, version number, revision number, and 
description information which will make up the header 
record. The address field is normally zeros. 

51 A record containing code/data and the 2-byte address 
at which the code/data is to reside. 

52 A record containing code/data and the 3-byte address 
at which the code/data is to reside. 

53 A record containing code/data and the 4- byte address 
at which the code/data is to reside. 

S5 A record containing the number of SI, S2, and S3 

records transmitted in a particular block. This count 
appears in the address field. There is no code/data 
field. 

S7 A termination record for a block of S3 records. The 

address field may optionally contain the 3-byte address 
of the instruction to which control is to be passed. 
There is no code/data field. 
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58 A termination record for a block of S2 records. The 
address field may optionally contain the 3-byte address 
of the instruction to which control is to be passed. 
There is no code/data field. 

59 A termination record for a block of SI records. The 
address field may optionally contain the 2-byte address 
of the instruction to which control is to be passed. 
Under VERSAdos, the resident linker's ENTRY 
command can be used to specify this address. If not 
specified, the first entry point specification 
encountered in the object module input will be used. 
There is no code/data field. 

Only one termination record is used for each block of S-records. S7 and S8 
records are usually used only when control is to be passed to a 3- or 4- byte 
address. Normally, only one header record is used, although it is possible 
for multiple header records to occur. 

CREATION OF S-RECORDS 

S- record-format programs may be produced by several dump utilities, 
debuggers, VERSAdos' resident linkage editor, or several cross assemblers 
or cross linkers. ON EXORmacs, the Build Load Module (MBLM) utility 
allows an executable load module to be built from S-records; and has a 
counterpart utility in BUILDS, which allows an S-record file to be created 
from a load module. 

Several programs are available for downloading a file in S-record format 
from a host system to an 8-bit microprocessor-based or 16-bit 
microprocessor-based system. Programs are also available for uploading 
an S-record file to or from an EXORmacs system. 

Example: Shown below is a typical S-record-format module, as printed or 
displayed: 
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S0060000484421B 

S 1 1 30000285 F 245 F22 1 2226A00042429000082337CA 

S 1 1 3001 00002000080008262900 1 85381 234 1 001 81 3 

S 1 1 300204 1 E9000084E42234300 1 82342000824A952 

S107003000144Ed492 

S9030000FC 



The module consist of one SO record, four SI records, and an S9 record. 
The SO record is comprised of the following character pairs: 



SO S-record type SO, indicating that it is a header record. 

06 Hexadecimal 06 (decimal 6), indicating that six character pairs (OR 
ASCII bytes) follow. 

00+ 

00 Four-character 2-byte address field, zeros in this example. 

48 

44+ ASCII H, D, and R ■ "HDR". 

52 

1B The checksum. 



The first SI record is explained as follows: 



S1 S-record type S1, indicating that it is a code/data record to be 
loaded/verified at a 2-byte address. 

13 Hexadecimal 13 (decimal 19), indicating that 19 character pairs, 
representing 19 bytes of binary data, follow. 

00+ Four-character 2-byte address field; hexadecimal address 

00 0000, where the data which follows is to be loaded. 
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The next 16 character pairs of the first SI record are the ASCII bytes of the 
actual program code/data. In this assembly language example, the 
hexadecimal opcodes of the programs are written in sequence in the 
code/data fields of the SI records: 



OPCODE 


INSTRUCTION 


285 F 


MOVE.L 


<A7) +,A4 


245 F 


MOVE.L 


(A7) +,A2 


2212 


MOVE.L 


(A2),D1 


226A0004 


MOVE.L 


4(A2),A1 


24290008 


MOVE.L 


FUNCTI0N(A1),D2 


237C 


MOVE.L 


#FORCEFUNC,FUNCTION(A1) 


o 


(The balance of this code is continued in the code/data 




fields of 


the remaining S1 records, and stored in memory 




location 


0010, etc.) 


2A 


The checksum of the first S1 record. 



The second and third SI records each also contain $13 (19) character pairs 
and are ended with checksums 13 and 52 respectively. The fourth SI 
record contains 07 character pairs and has a checksum of 92. 

The S9 record is explained as follows: 



S9 S- record type S9, indicating that it is a termination record. 

03 Hexadecimal 03, indicating that three character pairs (3 bytes) follow. 

00 The address field, zeros. 

FC The checksum of the S9 record. 



Each printable character in an S- record is encoded in hexadecimal (ASCII 
in this example) representation of the binary bits which are actually 
transmitted. 
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- A- 

Absolute address, 5-93 
Absolute values, 4-17 
Acknowledge char, 5-3 
Address 

Branch to, 7-25 
Address comparators, 7-3 
Address modes, 6-3 
Address registers, 5-92 
Alpha/numeric value, 4-8 
AND, 4-16, 7-10 
ASM, 6-44 

Assembler, 4-25, 6-44 
Prompt, 4-24 
Single step, 5-113 
Assembler directives, 6-46 



END, 6-44 
OVSix5-73 
X, 6-44 
BKX, 5-13 

Block data 

Verify, 6-38 
Block move, 6-39 

Verify, 6-40 
BMO, 6-39 

BNC connector, 3-6, 7-24 
Breaking emulation, 7-15 
Break on pre-fetch, 5-13 
Breakpoint, 7-15 
Breakpoints, 6-18 
Breaks on execution, 5-13 
Bus cycles, 5-96 
BUS, 6-89 
Byte mode, 4-26 



- B- 

Backspace, 4-29 
Base 

Default, 5-88 

Override default, 5-88 
Base register, 4-11 
Bases 

Override default, 4-12 
BAS, 5-83 

Baud rate, 3-10, 5-3, 5-38 
DMD, 4-26 
DML, 5-64 



-C- 

Cables, 3-8, 3-14 

CCT, 5-39 

CCT, 5-41,5-44 

CES,7-14 

Change SFO, 6-67 

Checksums, 5-47 

CK,5-17 

Clear memory map, 5-70 

Clear WHEN/THEN 

statements, 7-14 
CLK, 6-87 
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CLM, 5-70 

Clock, 5-17,6-87, B-3 

CMC, 5-109 

Colon operator, 5-114 

Command arguments 

Reducing typing, 5-92 
Commands 

Abbreviations, 7-1 

Command line, 4-6 

Commonly used, 4-21 

Configure system, 5-1 

Delay execution, 6-27 

Exceptions, 4-6 

Extend command line, 4-6 

Language overview, 1-7 

Memory, 6-31 

Mnemonics, 4-8 

Port dependent, 5-39 

Repeating, 5-94, 5-1 10, 5-1 13 

Run mode, 6-18 

Save space/typing, 5-90 

Single character, 4-7 

Terminator sequence, 5-3 
Communication with host, 5-39 
Communucation with target 

programs, 5-56 
Comparator registers, 7-2 
Computer port control, 5-48 
COM, 5-56 
Configuration 

Menus, 5-1 

System, 1-4, 2-4 
Control boards, 3-3 
Control characters, 4-29 
Copy system variables, 5-34 
Count bus cycles, 7-20 
Counter/timer use, 3-6, 7-24 
Counting events, 7-20 
Count limit comparator, 7-9 
CPU and emulator state 

transition, 6-7 
CPY, 5-18 
CRC, 6-88 
CRE, 6-88 
CRO, 6-88 
CRT length, 5-3 
Ctrl Q, 4-29 
Ctrl R, 4-29 



Ctrl S, 4-29 
Ctrl X, 4-29 
Ctrl Z, 4-29 

Customer service, 2-7, 2-12 
Cyclic redundancy check, 6-86, 
6-83 



- D- 

DATA 

DOWNLOADING, 5-46 
Data 

Buffering, 5-38 

Comparator registers, 7-4 

General purpose registers, 5-90 

Requirements, 3-12 

Serial data formats, C- 1 

Upload, 5-52 
DB-25 connectors, 5-38 
DB,6-33 
Debugging code with no 

hardware, 5-17 
Default base, 5-88 
Default base register, 4-11 
Delete line/character, 4-29 
DEL, 5-123 
Descriptor table, 6-2 

Examine, 6-6 

Modify, 6-6 
DES, 7-12 
DFB, 5-88 

Diagnostic functions, 1-11, 6-64 
Diagnostics 

CRC check of emulator 
firmware, 6-86 

RAM test - looping - 
simple, 6-70, 6-72 

RAM test - single pass - 
complete, 6-69 

RAM test - single pass - 
simple, 6-67 

Read data over entire 
range, 6-85 

Read from address, 6-76 

Toggle data at address, 6-74 

Write alternate patterns, 6-79 

Write data then read, 6-83 

Write data to address, 6-77 
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Write incrementing value, 6-84 

Write pattern then rotate, 6-81 
DIA, 5-60 

Disassemble memory, 5-100 
Disassembler, 6-50 

Single step, 5-110 
Disassemble trace memory, 5-100 
Disassemble trace page, 5-104 
Display 

Bus status, 6-89 

Character string, 5-60 

Event specifications, 7-12 

Improve readability, 5-127 

Memory block, 6-33 

Revision dates, 5-126 

Symbols, 5-119 
Display base, 5-88 
Display mode, 4-26 
Display raw trace bus cycles, 5-96 
DIS, 6-50 
DM, 5-63 
DNL, 5-40 
DNL, 5-46 
Don't care, 7-8 
Don't care values, 4-11, 5-74, 5-90, 

7-4 
Download 

Corruption, 5-51 

Errors, 5-49 

From computer port, 5-40 

From terminal port, 5-40 

Hex format files, 3-10 

Port control differences, 5-48 

Procedures, 5-46 

Record format, 5-7 

Symbols, 5-48 
DR, 5-78 
DRT, 5-96 
DTB, 5-104 
DTF, 5-104 
DT, 5-100 

-E- 

EEPROM 

Groups, 5-2 

Initialize. 5-37 

Save configuration, 5-1,5-10, 



5-36 
EMS control statements, 7-10 
Emulation, 6-18 

Breaking, 7-15 

Halting, 6-19 

Resetting, 6-20 

Run mode, 6-18 

Starting, 6-18 
Emulator 

Chassis rear panel, 3-6 

Control boards, 3-3 

Set-up, 2-1 
Error messages, 4-30, B-l 

Emulator hardware, B-l 

ES language, 4-31 

Software, B-l 

Target hardware, B-l 
Errors 

ESL, 4-30 
Escape sequence, 5-3 
Esc esc, 4-29 
ES language, 1-7,4-1 

Illegal statement, 4- 1 

Syntax, 4-2 
ES language mnemonics, A-l 
Event, 7-10 
Event Monitor System, 4-14, 7-1 

Address comparators, 7-3 

Clear WHEN/THEN, 7-14 

Comparator registers, 7-2 

Count events, 7-20 

Data and LSA comparators, 7-4 

Define action list, 7-11 

Define event, 7-10 

Event group changes, 7-27 

Groups, 7-1,7-10, 7-27 

Help menu, 4-22 

Interrupts, 7-25 

Registers, 5-77 

Status comparators, 7-5 

Status mnemonics, 7-6 

Trace events, 7-17 

Trigger signal, 7-24 
Event specs - display, 7-12 
Expression, 4-8 
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-F- 

Fan filter, cleaning, 3-15 

Files 

Closing, 5-53, 5-55 

Format, 3-10 

Opening, 5-54 

Viewing, 5-53 
Fill operator, 6-37 
FIL, 6-37 

Find memory pattern, 6-35 
FIN, 6-35 
FLX register, 5-79 
Forced special interrupt, 5-22 
FSX, 5-22 
Fuse, 3-7 



GD, 5-90 

General purpose address 

registers, 5-92 
Ground system, 3-1 
Groups, 4-14, 7-10, 7-27 
GR, 5-92 

-H- 

Hard copy, 5-11, 5-18 
Help, 4-20 

Communications set-up, 4-20 

Software switches, 4-20 

Special diagnostic functions, 4-20 
Host computer, 5-38 

Communication with, 5-39 

-I- 

IDX, 5-110 

:ILG, 5-67 

IM, 5-25 

Indirection operator, 4-9 

Internal/external clock, 5-17 

Interrupts 

Force special interrupt, 7-25 



Spcl interrupt register, 7-25 

Switch setting, 5-33 
Introspective mode, 5-25 
I/O address space 

Modifying, 6-52 

Viewing, 6-52 
I/O mode, 4-25, 6-52 

Entering, 6-57 

Exiting, 6-59 
I/O mode pointer, 5-87, 6-61 
IOP, 5-87, 6-61 



LD, 5-34 

LDV, 6-25 

LIM, 5-110 

Line assembler, 4-25, 6-44 

Prompt, 4-24 
Load 

Overlay memory, 5-71, 6-41 

Reset vectors, 6-25 

Variables from EEPROM, 5-34 
Logic state analyzer (LSA), 1-10, 

3-9 
LOV, 5-71 , 6-41 
LST, 6-60 

-M- 

MAC, 5-106 
Macros, 5-105 

Clearing, 5-109 

Define/execute, 5-107 

Displaying, 5-106 

Saving, 5-105 

Using registers, 5-90, 5-92 
Maintenance, 3-14 
MAP, 5-66 
Memory 

Alternate overlay/target, 5-11 

Assembler, 6-44 

Block display, 6-33 

Commands, 6-31 

Disassembler, 4-25, 6-50 
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Display overlay map, 5-63 

Download to overlay, 5-46 

Fill with data, 6-37 

Find data pattern, 6-35 

Load overlay, 6-41 

Load target to overlay, 5-71 

Map overlay, 5-66 

Mode, 6-52 

Modify, 6-52 

Overlay, 5-62 

Overview, 1-8 

Scrolling, 6-33 

Scroll through, 6-52 

Set overlay speed, 5-73 

Trace (See also Trace), 5-95 

Verify overlay, 5-72, 6-42 

Viewing, 6-52 
Memory mode, 4-25, 6-52 

Entering, 6-54 

Exiting, 6-59 

Modifying data, 6-55 

Prompt, 4-24 

Scrolling, 6-60 
Memory mode pointer, 5-85, 6-62 
Microprocessor registers, 5-75, 5-78 
MIO, 6-57 
MMP, 5-85, 6-62 
Modes 

Display, 4-26 

Introspective, 5-25 

I/O, 6-52 

IO (see I/O), 4-25 

Memory, 6-52 

Pause, 7-15 

Run, 6-1 

Special, 4-25 

Transparent, 5-41 
M, 6-54 

-N- 

NOT, 4-15, 7-10 
Null modem cable, 2-3 
Null target, 1-8 
Numbers, 4-11 
Signed, 4-16 
NXT, 6-60 



-O- 

OFF, 5-9 

ON/OFF menu, 5-1, 5-9 
ON, 5-9 

Operators 

Dyadic operator 
combinations, 4-19 

Indirection, 4-9 

Precedence, 4-17 

Repeat, 5-110 

Single argument, 4-18 

Unary, 4-16 
OR, 4-16, 7-10 
Oscilloscope, 1-11 
Oscilloscope use, 3-6, 6-64, 7-24, 

B-l 
Overlay map, 5-67 
Overlay memory 

Set speed, 5-73 

Verify, 6-42 
Overlay memory (see Memory), 1-9 

-P- 

Parentheses, 4-8, 7-10 

Indirection, 4-13 

When/Then, 4-15 
Parity, 5-3 
Parts, 3-18 
Patch code, 7-25 
Pause mode, 1-7, 7-15 
Peeks, 6-76 

Peripheral equipment, 3-6 
Physical mode, 6-4, 6-9 
Pin configurations, 3-10 
Pod assembly, 3-8 
Pokes, 6-77 
Port control 

Computer, 5-44 

Terminal, 5-43 

Transparent mode, 5-41 
Ports 

Copy data to, 5-18 
Ports, 3-6 

Baud rate, 3-10 
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Commands, 5-39 

Computer control, 5-44 

Configuration, 5-3, 5-38 

Control, 5-39 

Controlling port, 5-44 

Download data, 5-47 

Port control, 3-10, 5-41, 5-43, 

5-44 
Terminal control, 5-43 
Upload/download, 3-10 

Power on sequence, 2-6 

Power specs, 3-16 

Power supply, 3-1 

Prefetch, 5-13, 5-22 

Print session, 5-11,5-18 

Privilege levels, 6-3 

Probe tip assembly, 3-14 

Prompts, 4-24 

PUR, 5-124 

-R- 

RAM 

See Diagnostics, 6-64 

Testing, 6-64 
Range, 4-11 
RBK, 6-21 
RBV, 6-21 
RDY, 5-29 
Readability, 5-127 
Ready signal, 5-29 
Real time, 1-8 
Register 

Data, 7-4 
Registers, 5-74 

Address, 7-3 

Clearing microprocessor, 5-78 

Comparator, 7-2—7-7 

Count, 7-20 

Count limit, 7-9 

Display, 5-78 

Display base, 5-77 

Event Monitor System, 5-77 

General Emulator, 5-76 

General Purpose, 5-105 

General purpose address, 5-92 

General purpose data, 5-90 

Listing, 5-74 



Load, 5-78 

Logic state probe, 7-4 

Microprocessor, 5-75 

Overlay memory, 5-62 

Reset status, 6-29 

Saving, 5-77 

Set/display base, 5-83 

Status, 7-5 

Types,, 4-14 

Using in run mode, 6-20 
Registers in virtual mode, 6-9 
Repeat command line, 4-6, 5-110, 

5-113 
Repeating commands 

ESL, 4-6 
Reset character, 5-3 
Reset pod microprocessor, 6-29 
RET, 5-127 
Revision dates, 5-126 
REV, 5-126 
RNV.6-21 
RO, 5-67 
*, 5-110 
/, 5-113 
RST, 6-29 

Run commands, 6- 1 8 
Run mode, 6-1, 6-18, 7-1 
Run mode prompt, 4-24 
RUN, 6-21 

Run target program, 6-21 
RW, 5-66 

-S- 

Saved 

ON/OFF menu, 5-1 

Parameters, 5-8 

Registers, 5-77 

SET menu, 5-1 

Switches, 5-11 

System variables, 5-36 
SAV, 5-36 
Scope loops, 6-64 

Scroll through memory, 6-33, 6-60 
SEC, 5-120 
Sections, 5-114 

Deleting, 5-123, 5-124 

Display, 5-120 
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Segment register, 6-2 
Serial communications, 5-38 
Serial ports (see Ports), 3-6 
Service, 0-4, 2-7, 2-12 
SET menu, 5-1, 5-3 
Set overlay speed, 5-73 
SET, 5-3 
Set-up 

Emulator, 2-1 

System, 1-4 

Target system, 2-5 
SF 

0-32 (See Diagnostics), 6-67 
SF 0, 6-67 
SF 11, 6-84 
SF 12, 6-85 
SF 13, 6-86 
SF 1, 6-69 
SF 24, 6-74 
SF 25, 6-76 
SF 26, 6-77 
SF 27, 6-79 
SF 28, 6-81 
SF 29, 6-83 
SF 31, 6-84 
SF 32, 6-85 
SF 3, 6-72 
SF 4, 6-74 
SF5,6-76 
SF6,6-77 
SF 7, 6-79 
SF 8, 6-81 
SF 9, 6-83 

Special characters, 4-29 
Special functions 

See Diagnostics, 6-66 
Special interrupts, 7-25 
Special modes, 4-25 
Specifications 

ES 1800 Emulator, 3-20 
S-records 

creation, C-17 

types, C-16 
Status comparators, 7-5 
STI, 5-33 

Stop and step target system, 6-23 
Stop bits, 5-3 



Switches, 5-9 

Break on instruction 
execution, 5-13 

Copy data to both ports, 5-18 

FSl on instruction 
execution, 5-22 

Internal/external ready 
signal, 5-29 

Introspective mode, 5-25 

Set through interrupts, 5-33 
Symbolic download, 5-44 
Symbols, 4-11, 5-114 

Define, 5-121 

Deleting, 5-123, 5-124 

Display, 5-119 

Downloading, 5-48 

Symbolic debugger, 1-10 

Table, 5-114 

Uploading, 5-54 
SYM, 5-119 

System configuration, 1-4, 2-4 
System operation, 1-7 
System setup, 1-4, 5-1 
System variables, 5-36 



Target, 6-1 

Commands, 6-1 

Communication with, 5-56 

Cyclic redundancy check, 6-88 

Definition, 6-1 

Display characters from 
memory, 5-60 

Download to, 5-46 

Hardware errors, B-l 

Load into Emulator, 6-41 

Null, 1-8 

Read clock, 6-87 

Run program, 6-21 

Stop andstep system, 6-23 

System peeks, 6-76 

System pokes, 6-77 

System set-up, 2-5 
TCT, 5-39 
TCT, 5-41, 5-43 
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Temperature, 3-16 

Terminal port control, 5-47 

Test run of system, 2-7 

TGT, 5-67 

Thumbwheel switch, 2-2, 3-3, 3-4 

Trace 

Disassemble page, 5-104 

Display bus cycles, 5-96 
Trace a subroutine, 7-27 
Trace bus cycles, 7-17 
Trace memory, 1-8, 5-95 
Tracing events, 7-17 
Transparent mode, 4-25, 5-38, 
5-41 

Entering, 5-39 

Exiting, 5-39 
TRA, 5-41 
Trigger signal, 7-24 
Troubleshooting, 3-15 
TST, 5-94 



VFY,5-51 

Virtual mode, 6-4, 6-9 

Registers, 6-9 
Virtual operations, 6-2 
Virtual operations chart, 6-8 

- W- 

WAI, 6-27 

Warranty, 0-5 

WHEN/THEN, 1-9, 7-1, 7-14 
Word mode, 4-26 

- X- 

XON/XOFF, 3-12, 5-3, 5-38, 

5-53,6-34 
X, 6-59 



-U- 

Unary operator, 4-16 

Upload 

Data, 5-52 

Hex format files, 3-10 
Record format, 5-7 
Record length, 5-7 
Symbols, 5-54 

UPL, 5-52 

UPS, 5-54 

Users 

Specify Oor 1, 5-4 

- V- 

VBL, 6-38 

VBM, 6-40 

Vectors 

Load reset, 6-25 

Verify 

Block data, 6-38 
Block move, 6-40 
Overlay memory, 5-72 
Serial data, 5-51 

VFO, 5-72, 6-42 
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